openapi: 3.0.1
info:
  title: PingOne Advanced Identity Cloud - Identity Governance (IGA)
  description: This is the API specification for the Access Request related endpoints and data model for PingOne Advanced Identity Cloud - Identity Governance (IGA). 
  version: "1.0.0"
servers:
  - url: /iga
tags:
  - name: Access Request
    description: Access request endpoints.
  - name: Account
    description: Account endpoints
  - name: Audit
    description: Endpoints associated with IDM's audit functionality
  - name: Catalog
    description: Catalog endpoints.
  - name: Certification
    description: Certification endpoints
  - name: Config
    description: Configuration endpoints.
  - name: Event
    description: Event rule endpoints.
  - name: Job
    description: Job related endpoints.
  - name: Request Form
    description: Request form endpoints.
  - name: Request Type
    description:  Request type endpoints
  - name: Provisioning
    description: Access provisioning endpoints.
  - name: Scope
    description: Scoping related endpoints.
  - name: Segregation of Duty
    description: SoD and Policy endpoints.
  - name: Task
    description: Task related endpoints.
  - name: User
    description: User related endpoints.
  - name: Workflow
    description: Workflow related endpoints.
  - name: Evolving
    description: Evolving APIs. These APIs might get deprecated in future with improved alternatives.
paths:
  /governance/catalog:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Catalog
      description: Get a list of items from the IGA Access Catalog.  Each entry represents a single type of requestable access that can be added to a request.  The current supported types of access that are requestable are application, entitlement, and role.
      summary: Get catalog items.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/ignoreRequestable"
        - $ref: "#/components/parameters/catalogUserId"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Catalog'
              examples:
                application:
                  value: {
                    "id" : "26f2bd6b-3d23-4fbb-92f7-9aecd0183852",
                    "item" : {
                      "type" : "accountGrant"
                    },
                    "application" : {
                      "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-50136",
                      "authoritative" : true,
                      "connectorId" : "AzureADAuth1",
                      "description" : "AD Auth App1",
                      "fr" : {
                        "realm" : "alpha"
                      },
                      "icon" : "https://openam-glossary-fix-0608.forgeblocks.com/platform/img/microsoft.8a785075.svg",
                      "id" : "26f2bd6b-3d23-4fbb-92f7-9aecd0183852",
                      "mappingNames" : [
                        "systemAzureadauth1User_managedAlpha_user"
                      ],
                      "metadata" : {
                        "entityType" : "/openidm/managed/application",
                        "created" : "2023-06-09T15:01:49.259Z"
                      },
                      "name" : "AzureADAuth1",
                      "templateName" : "azure.ad",
                      "templateVersion" : "2.0"
                    },
                    "applicationOwner" : [
                      {
                        "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-1944",
                        "accountStatus" : "active",
                        "cn" : "iga admin",
                        "fr" : {
                          "realm" : "alpha"
                        },
                        "givenName" : "iga",
                        "id" : "b409de90-dc24-42ee-b315-7e133c7cfaca",
                        "mail" : "iga-admin@fr.net",
                        "metadata" : {
                          "entityType" : "/openidm/managed/user",
                          "created" : "2023-06-08T23:02:15.385Z"
                        },
                        "sn" : "admin",
                        "userName" : "iga-admin"
                      }
                    ],
                    }
                entitlement:
                  value: {
                    "id" : "system_TargetADApp2_directoryRole_08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
                    "item" : {
                      "type" : "entitlementGrant"
                    },
                    "descriptor" : {
                      "idx" : {
                        "/entitlement" : {
                          "displayName" : "Directory Readers"
                        }
                      }
                    },
                    "glossary" : {
                      "idx" : {
                        "/entitlement" : {
                          "requestable" : true
                        }
                      }
                    },
                    "entitlement" : {
                      "_id" : "08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
                      "description" : "Can read basic directory information. Commonly used to grant directory read access to applications and guests.",
                      "displayName" : "Directory Readers"
                    },
                    "assignment" : {
                      "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-72216",
                      "attributes" : [
                        {
                          "name" : "__roles__",
                          "value" : [
                            "08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4"
                          ]
                        }
                      ],
                      "description" : "Can read basic directory information. Commonly used to grant directory read access to applications and guests.",
                      "fr" : {
                        "realm" : "alpha"
                      },
                      "id" : "system_TargetADApp2_directoryRole_08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
                      "mapping" : "managedAlpha_user_systemTargetadapp2User",
                      "metadata" : {
                        "entityType" : "/openidm/managed/assignment",
                        "created" : "2023-06-09T22:09:42.877Z"
                      },
                      "name" : "Directory Readers",
                      "type" : "__ENTITLEMENT__"
                    },
                    "application" : {
                      "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-67718",
                      "authoritative" : false,
                      "connectorId" : "TargetADApp2",
                      "description" : "Target AD App2",
                      "fr" : {
                        "realm" : "alpha"
                      },
                      "icon" : "https://openam-glossary-fix-0608.forgeblocks.com/platform/img/microsoft.8a785075.svg",
                      "id" : "a4e54fcb-9088-4d42-bb4a-138d69b2486e",
                      "mappingNames" : [
                        "systemTargetadapp2User_managedAlpha_user",
                        "systemTargetadapp2Directoryrole_managedAlpha_assignment",
                        "systemTargetadapp2__group___managedAlpha_assignment",
                        "managedAlpha_user_systemTargetadapp2User"
                      ],
                      "metadata" : {
                        "entityType" : "/openidm/managed/application",
                        "created" : "2023-06-09T20:43:57.74Z"
                      },
                      "name" : "TargetADApp2",
                      "ssoIdentities" : {
                        "oidcId" : "TargetADApp2"
                      },
                      "templateName" : "azure.ad",
                      "templateVersion" : "2.0"
                    },
                    "applicationOwner" : [
                      {
                        "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-1944",
                        "accountStatus" : "active",
                        "cn" : "iga admin",
                        "fr" : {
                          "realm" : "alpha"
                        },
                        "givenName" : "iga",
                        "id" : "b409de90-dc24-42ee-b315-7e133c7cfaca",
                        "mail" : "iga-admin@fr.net",
                        "metadata" : {
                          "entityType" : "/openidm/managed/user",
                          "created" : "2023-06-08T23:02:15.385Z"
                        },
                        "sn" : "admin",
                        "userName" : "iga-admin"
                      }
                    ]}
                role:
                  value: {
                    "id" : "4696b160-b035-402c-8335-08a8d5038508",
                    "item" : {
                      "type" : "roleMembership"
                    },
                    "role" : {
                      "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-342913",
                      "fr" : {
                        "realm" : "alpha"
                      },
                      "id" : "4696b160-b035-402c-8335-08a8d5038508",
                      "metadata" : {
                        "entityType" : "/openidm/managed/role",
                        "created" : "2023-06-13T16:01:15.295Z"
                      },
                      "name" : "Temporal Test",
                      "temporalConstraints" : [
                        {
                          "duration" : "2023-06-13T16:00:00.000Z/2023-07-06T16:00:00.000Z"
                        }
                      ]
                    }}
    post:
      tags:
        - Catalog
      description: Get a list of items from the IGA Access Catalog using additional filter criteria.  Each entry represents a single type of requestable access that can be added to a request.  The current supported types of access that are requestable are application, entitlement, and role.
      summary: Search catalog items.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/ignoreRequestable"
        - $ref: "#/components/parameters/catalogUserId"
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  properties:
                    targetFilter:
                      $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/Catalog'
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                    example: 1
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
                    example: 1
  /governance/search/schema:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Catalog
      summary: Get the properties available to filter by/search when using the catalog API.
      description: This endpoint will retrieve all of the currently configured properties that are eligible to be used for search/sort when searching against the catalog API.  Each property will include some additional metadata about the property, such as whether or not the property is multi value and its data type.
      responses:
        201:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  application:
                    type: array
                    items:
                      $ref: '#/components/schemas/CatalogSchemaProperty'
                  entitlement:
                    type: array
                    items:
                      $ref: '#/components/schemas/CatalogSchemaProperty'
                  role:
                    type: array
                    items:
                      $ref: '#/components/schemas/CatalogSchemaProperty'
              example: {
                "application": [
                    {
                        "key": "application.description",
                        "name": "description",
                        "displayName": "Description",
                        "description": "Application Description",
                        "type": "string",
                        "isMultiValue": false
                    },
                    {
                        "key": "application.name",
                        "name": "name",
                        "displayName": "Name",
                        "description": "Application name",
                        "type": "string",
                        "isMultiValue": false
                    }
                ],
                "entitlement": [
                    {
                        "key": "glossary.idx./entitlement.description",
                        "allowedValues": [],
                        "isIndexed": true,
                        "isMultiValue": false,
                        "managedObjectType": null,
                        "searchable": true,
                        "isInternal": true,
                        "displayName": "Description",
                        "name": "description",
                        "description": "Description of entitlement",
                        "objectType": "/openidm/managed/assignment",
                        "type": "string"
                    },
                    {
                        "key": "entitlement.displayName",
                        "name": "displayName",
                        "displayName": "Display Name",
                        "description": "",
                        "type": "text",
                        "isMultiValue": false
                    },
                    {
                        "key": "glossary.idx./entitlement.entitlementOwner",
                        "allowedValues": [],
                        "isIndexed": true,
                        "isMultiValue": false,
                        "managedObjectType": "/openidm/managed/user",
                        "searchable": true,
                        "isInternal": true,
                        "displayName": "Entitlement Owner",
                        "name": "entitlementOwner",
                        "description": "Entitlement Owner of Object",
                        "objectType": "/openidm/managed/assignment",
                        "type": "managedObject"
                    },
                    {
                        "key": "glossary.idx./entitlement.requestable",
                        "allowedValues": [],
                        "isIndexed": true,
                        "isMultiValue": false,
                        "managedObjectType": null,
                        "searchable": true,
                        "isInternal": true,
                        "displayName": "Requestable",
                        "name": "requestable",
                        "description": "Can the entitlement be requested",
                        "objectType": "/openidm/managed/assignment",
                        "type": "boolean"
                    }
                ],
                "role": [
                    {
                        "key": "role.applications._ref",
                        "name": "applications",
                        "displayName": "Applications",
                        "description": "Role Applications",
                        "type": "managedObject",
                        "isMultiValue": true,
                        "managedObjectType": "/openidm/managed/alpha_application"
                    },
                    {
                        "key": "role.description",
                        "name": "description",
                        "displayName": "Description",
                        "description": "The role description, used for display purposes.",
                        "type": "string",
                        "isMultiValue": false
                    },
                    {
                        "key": "role.id",
                        "name": "_id",
                        "displayName": "Name",
                        "description": "Role ID",
                        "type": "string",
                        "isMultiValue": false
                    },
                    {
                        "key": "role.name",
                        "name": "name",
                        "displayName": "Name",
                        "description": "The role name, used for display purposes.",
                        "type": "string",
                        "isMultiValue": false
                    },
                    {
                        "key": "glossary.idx./role.requestable",
                        "allowedValues": [],
                        "isIndexed": true,
                        "isMultiValue": false,
                        "managedObjectType": null,
                        "searchable": true,
                        "isInternal": true,
                        "displayName": "Requestable",
                        "name": "requestable",
                        "description": "Can the role be requested",
                        "objectType": "/openidm/managed/role",
                        "type": "boolean"
                    },
                    {
                        "key": "role.members._ref",
                        "name": "members",
                        "displayName": "Role Members",
                        "description": "Role Members",
                        "type": "managedObject",
                        "isMultiValue": true,
                        "managedObjectType": "/openidm/managed/alpha_user"
                    }
                ]
              }
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/search/schema/{objectType}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Catalog
      summary: Get the properties available to filter by/search for a specific object when using the catalog API.
      description: This endpoint will retrieve all of the currently configured properties that are eligible to be used for search/sort for a single object when searching against the catalog API.  For example, all of the entitlement specific properties you can use to search.  Each property will include some additional metadata about the property, such as whether or not the property is multi value and its data type.
      parameters:
      - name: objectType
        in: path
        required: true
        description: Type of object to get filter properties for.
        schema:
          type: string
          enum: [ 'application', 'entitlement', 'role' ]
      responses:
        201:
          description: OK.
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
              examples:
                application:
                  value:
                  - key: application.description
                    name: description
                    displayName: Description
                    description: Application Description
                    type: string
                    isMultiValue: false
                  - key: application.name
                    name: name
                    displayName: Name
                    description: Application name
                    type: string
                    isMultiValue: false
                entitlement:
                  value:
                  - key: glossary.idx./entitlement.description
                    allowedValues: [ ]
                    isIndexed: true
                    isMultiValue: false
                    managedObjectType:
                    searchable: true
                    isInternal: true
                    displayName: Description
                    name: description
                    description: Description of entitlement
                    objectType: "/openidm/managed/assignment"
                    type: string
                  - key: entitlement.displayName
                    name: displayName
                    displayName: Display Name
                    description: " "
                    type: string
                    isMultiValue: false
                  - key: glossary.idx./entitlement.entitlementOwner
                    allowedValues: [ ]
                    isIndexed: true
                    isMultiValue: false
                    managedObjectType: "/openidm/managed/user"
                    searchable: true
                    isInternal: true
                    displayName: Entitlement Owner
                    name: entitlementOwner
                    description: Entitlement Owner of Object
                    objectType: "/openidm/managed/assignment"
                    type: managedObject
                  - key: glossary.idx./entitlement.requestable
                    allowedValues: [ ]
                    isIndexed: true
                    isMultiValue: false
                    managedObjectType:
                    searchable: true
                    isInternal: true
                    displayName: Requestable
                    name: requestable
                    description: Can the entitlement be requested
                    objectType: "/openidm/managed/assignment"
                    type: boolean
                role:
                  value:
                  - key: role.description
                    name: description
                    displayName: Description
                    description: The role description, used for display purposes.
                    type: string
                    isMultiValue: false
                  - key: role.id
                    name: _id
                    displayName: Name
                    description: Role ID
                    type: string
                    isMultiValue: false
                  - key: role.name
                    name: name
                    displayName: Name
                    description: The role name, used for display purposes.
                    type: string
                    isMultiValue: false
                  - key: glossary.idx./role.requestable
                    allowedValues: [ ]
                    isIndexed: true
                    isMultiValue: false
                    managedObjectType:
                    searchable: true
                    isInternal: true
                    displayName: Requestable
                    name: requestable
                    description: Can the role be requested
                    objectType: "/openidm/managed/role"
                    type: boolean
                  - key: role.members._ref
                    name: members
                    displayName: Role Members
                    description: Role Members
                    type: managedObject
                    isMultiValue: true
                    managedObjectType: "/openidm/managed/alpha_user"
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}

  /governance/requestTypes:
    get:
      tags:
        - Request Type
      description: Get list of supported request type
      parameters:
      - name: _queryFilter
        in: query
        description: The query filter for searching
        schema:
          type: string
      - name: _pageSize
        in: query
        description: Number of results per page
        schema:
          type: string
      - name: _pageNumber
        in: query
        description: Page number of results to show
        schema:
          type: string
      - name: _fields
        in: query
        description: Properties to return in the results
        schema:
          type: string
      - name: _sortBy
        in: query
        description: The property to sort the results by
        schema:
          type: string
      - name: _pagedResultsOffset
        in: query
        description: The offset of the first element of the page
        schema:
          type: integer
      - name: _sortKeys
        in: query
        description: Property to sort the results by.  Prefix + or - to the property name for ascending or descending order.
        schema:
          type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/RequestType'
    post:
      tags:
        - Request Type
      description: Create new custom request type
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestType'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestType'
        400:
          description: missing required properties
  /governance/requestTypes/{requestTypeId}:
    get:
      tags:
        - Request Type
      description: Get the request type by ID
      parameters:
        - name: requestTypeId
          in: path
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestType'
        404:
          description: Request Type ID not found
    put:
      tags:
        - Request Type
      description: Replace existing request type
      parameters:
        - name: requestTypeId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestType'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestType'
        400:
          description: Missing Required Properties
    patch:
      tags:
        - Request Type
      description: Update request type
      parameters:
        - name: requestTypeId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchPayload'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RequestType'
        400:
          description: Missing Required Properties
    delete:
      tags:
        - Request Type
      description: Delete request type
      parameters:
        - name: requestTypeId
          in: path
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
        404:
          description: Request Type ID not found

  /governance/requests:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Access Request
      summary: Create or validate new access request for list of users.
      description: For submitting a new request for access, which will validate the contents of the request, and if there are no issues, create a request for each user-to-catalog item pairing that the request contains.  To only check validation an _action of validate is supported, which will allow the caller to see any errors that exist with the current request payload.  Regardless of result, no requests will be created when that action is used.
      parameters:
        - $ref: "#/components/parameters/allRequestsAction"
        - name: runPreventativeScan
          in: query
          description: Check whether the requested access violates any policies.
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessRequestForUsers'
      responses:
        200:
          description: Success.
          content:
            application/json:
              schema:
                anyOf:
                  - type: object
                    description: Request submission response.
                    properties:
                      result:
                        type: array
                        description:  This contains the list of unique request IDs that were generated by the submitted payload.
                        items: 
                          type: string
                          example: f70b1565-8d42-4492-93dd-90173fa62635
                      errors:
                        type: array
                        description:  This contains the list of validation errors that were found when evaluating the submitted payload.
                        items: 
                          $ref: '#/components/schemas/AccessRequestValidationError'
        400:
          description: Request error.
          content:
            application/json:
              schema:
                anyOf:
                  - type: object

  /governance/requests/{requestTypeId}:
    post:
      tags:
        - Access Request
      description: Create request
      summary: Create request of the given request type. 
      parameters:
        - name: requestTypeId
          in: path
          required: true
          description: The ID of the request type
          schema:
            type: string
      requestBody:
        description: The payload for creating request.  Properties must match the request type schema definition.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessRequestDetail'
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessRequestDetail'    
  /governance/requests/{requestId}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Access Request
      description: Retrieve the details of a single access request using its unique identifier.
      summary: Get access request by ID.
      parameters:
        - name: requestId
          in: path
          required: true
          description: The unique identifier of the request to get.
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessRequestDetail'
        404:
          description: Request cannot be found.
    put:
      tags:
        - Access Request
      description: Replace request
      summary: Replace the content of a request.  The only properties that it can be changed are properties that are defined in the request schema, and not in the notModifiableProperties.
      parameters:
        - name: requestId
          in: path
          required: true
          description: The ID of the request
          schema:
            type: string
      requestBody:
        description: The payload for replacing request content.  Properties must match the request type schema definition of this request
        required: true
        content:
          application/json:
              schema:
                $ref: '#/components/schemas/AccessRequestDetail'
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessRequestDetail'    
    patch:
      tags:
        - Access Request
      description: Update request
      summary: Update the content of a request.  The only properties that it can be updated are properties that are defined in the request schema, and not in the notModifiableProperties.
      parameters:
        - name: requestId
          in: path
          required: true
          description: The ID of the request
          schema:
            type: string
      requestBody:
        description: The payload for updating request
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PatchPayload"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessRequestDetail'
    post:
      tags:
        - Access Request
      description: Perform various actions on a specific request, such as approve, reject, comment, cancel, update, or reassign.  Each action may have different payloads depending on the information the caller needs to provide.
      summary: Take action on a request.
      parameters:
        - name: requestId
          in: path
          required: true
          description: The unique identifier of the request to act on.
          schema:
            type: string
        - name: phaseName
          in: query
          description: For approval task specific actions, the name of the task that the action applies to.
          schema:
            type: string
        - $ref: "#/components/parameters/singleRequestAction"
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  properties:
                    comment:
                      type: string
                      example: "Can someone please expedite this approval?"
                      description: The comment text that will be added to the request.
                - type: object
                  properties:
                    justification:
                      type: string
                      example: "I am not approving this access because it was incorrectly requested."
                      description: The reason for the approver's decision of reject or approve.
                - required: [ updatedActors ]
                  properties:
                    updatedActors:
                      type: array
                      description: The list of users or roles that are assigned to take action on the given approval task, and their individual permissions (comment, approve, etc.).  Note that this list will replace the entire list of users/roles currently assigned to the task, so any current users/roles that should remain on the task should also be included.
                      items:
                        $ref: '#/components/schemas/RequestActor'
                - $ref: "#/components/schemas/AccessRequest"
                  description: For modify request action, the entire contents of the "request" key on the request object must be provided, including any updated values.  Note that some properties are not modifiable on a request.
                - type: object
                  description: Values to change for progress keys (status/decision/outcome) for the admin update _action.  This action allows orchestration to determine when and how a request progresses through its lifecycle.  For example, when a request has met the criteria for being successfully approved, the decision key can be set to 'approved'.  When access has been successfully provisioned, the status can be changed to 'complete' and the outcome to 'provisioned'.
                  properties:
                    status:
                      type: string
                      enum: [ "in-progress", "provisioning", "complete", "cancelled" ]
                      description: The current progress status of the overall request. 'in-progress' is an active request, 'provisioning' is an active request that has been approved but not yet fufilled, 'complete' is a request that has been closed out, and 'cancelled' is one that has been explicitly cancelled.
                    decision:
                      type: string
                      enum: [ "approved", "rejected" ]
                      description: The final decision made on the request.  Note this differs from the decision value on a single approval task and represents the overall request decision, as determined by orchestration.  For example, a request flow could create three approval tasks over its lifecycle and if 2 out of 3 approve the access, it may determine the final decision is approve.  Or it could decide if any of the three are rejected then the final decision is rejected.
                    outcome:
                      type: string
                      enum: [ "provisioned", "not provisioned", "denied", "cancelled", "fulfilled" ]
                      description: The final result of the action that the request was for.  For example, if the request is to add an entitlement to a user and the entitlement is provisioned as expected, the outcome would be 'provisioned'.  If the provisioning was intended but was not completed (e.g. access already granted, provisioning failure), the outcome would be 'not provisioned'. 'denied' is a request that did not get the required approval(s). 'cancelled' is a request that was cancelled before completion.
                    comment:
                      type: string
                      example: "Can someone please expedite this approval?"
                      description: The comment text that will be added to the request.
                    failure:
                      type: boolean
                      description : Indicates whether the comment should be marked in the list of comments as a failure reason.
                      default: false
            examples:
              comment:
                value: {
                  "comment": "Can someone please expedite this approval?"
                }
              approve:
                value: {
                  "justification": "Looks good to me."
                }
              reject:
                value: {
                  "justification": "I am not approving this access because it was incorrectly requested."
                }
              cancel: 
                value: {

                }
              reassign:
                value: {
                  "comment" : "This was reassigned due to PTO",
                  "updatedActors": [
                    {
                      "id": "managed/user/694a7124-f567-4049-836e-4600acee1f37",
                      "mail": "fyork@frgov.net",
                      "givenName": "Frank",
                      "sn": "York",
                      "userName": "fyork",
                      "phase": "ManagerApproval",
                      "permissions": {
                          "approve": true,
                          "comment": true,
                          "modify": false,
                          "reassign": true,
                          "reject": true
                      }
                    },
                    {
                      "id": "managed/user/f70b1565-8d42-4492-93dd-90173fa62635",
                      "mail": "abean@frgov.net",
                      "givenName": "Amy",
                      "sn": "Bean",
                      "userName": "abean",
                      "phase": "ManagerApproval",
                      "permissions": {
                          "approve": false,
                          "comment": true,
                          "modify": false,
                          "reassign": false,
                          "reject": false
                      }
                    }
                  ]
                }
              modify:
                value: {
                  "common": {
                      "priority": "low",
                      "justification": "Request justification",
                      "roleId": "3030d401-90f2-4219-82ea-4f71b3ed4abc",
                      "userId": "f5dcd246-92f6-4e32-a696-7ec3253cec16",
                      "externalRequestId": "237",
                      "isDraft": false
                  }
                }
              update:
                value: {
                  "status": "complete",
                  "decision": "approved",
                  "outcome": "provisioned",
                  "comment": "Access approved and auto-provisioned, request is complete."
                }
              update 2:
                value: {
                  "status": "provisioning",
                  "decision": "approved",
                  "comment": "Access has been sufficiently approved, moving on to provisioning."
                }
              update 3:
                value: {
                  "status": "complete",
                  "outcome": "not provisioned",
                  "comment": "Access was not provisioned since user has already been granted access, request is complete."
                }
              update 4:
                value: {
                  "status": "complete",
                  "decision": "rejected",
                  "outcome": "denied"
                }
      responses:
        200:
          description: OK.
        400:
          description: Invalid action.
        401:
          description: User is not authorized to use this endpoint.
        404:
          description: Request cannot be found.

  /governance/user/{userId}/requests:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Access Request
      summary: Get requests user has permissions to view.
      description: Get requests for which the authenticated user has permissions to view. For additional search capabilities, use the POST /governance/user/{userId}/requests?_action=search API.
      parameters:
        - $ref: "#/components/parameters/userIdForRequests"
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: "#/components/schemas/AccessRequestDetail"
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
    post:
      tags:
        - Access Request
      summary: Get requests user has permissions to view.
      description: Get requests for which the authenticated user has permissions to view. The targetFilter property in the API payload can be used to filter the requests based on the desired criteria.
      requestBody:
        content:
          '*/*':
            schema:
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      parameters:
        - $ref: "#/components/parameters/userRequestsAction"
        - $ref: "#/components/parameters/userIdForRequests"
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: "#/components/schemas/AccessRequestDetail"
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
  /governance/user/{userId}/approvals:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Access Request
      summary: Get requests for which the user is assigned to act on.
      description: Get requests the authenticated user is assigned, either directly, through a role, or through a delegate. The targetFilter property in the API payload can be used to filter the requests based on the desired criteria.
      requestBody:
        content:
          '*/*':
            schema:
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      parameters:
        - $ref: "#/components/parameters/userApprovalsAction"
        - $ref: "#/components/parameters/userIdForRequests"
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
        - name: actorStatus
          in: query
          description: Status of the approver to search on, e.g. "active", "inactive".  Active will show tasks which are currenty assigned to the user, while inactive will show tasks that they were assigned and have been completed.
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: "#/components/schemas/AccessRequestApprovalDetail"
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.

  /governance/user/{userId}/applications:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Provisioning
      description: Provision or de-provision applications for a user.
      summary: Provision or de-provision applications for a user.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProvisionApplicationRequest"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
      parameters:
        - $ref: "#/components/parameters/userIdForRequests"
        - $ref: "#/components/parameters/accessProvisioningAction"
  /governance/user/{userId}/roles:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Provisioning
      description: Provision or de-provision roles for a user.
      summary: Provision or de-provision roles for a user.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProvisionRoleRequest"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
      parameters:
        - $ref: "#/components/parameters/userIdForRequests"
        - $ref: "#/components/parameters/accessProvisioningAction"
  /governance/user/{userId}/entitlements:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Provisioning
      description: Provision or de-provision entitlements for a user.
      summary: Provision or de-provision entitlements for a user.
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProvisionEntitlementRequest"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
      parameters:
        - $ref: "#/components/parameters/userIdForRequests"
        - $ref: "#/components/parameters/accessProvisioningAction"
  /commons/config:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Config
      description: Reads and returns all of the IGA configuration properties, across all categories (currently only iga_access_request configuration is available.)  These properties are used throughout IGA to determine how certain functionality should behave. For example, iga_access_request contains configuration for whether or not justification is required to reject a request, or whether or not a user can approve their own access.
      summary: Get all IGA configuration settings.
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IGAConfig'
        400:
          description: IGA configuration settings cannot be read.

    put:
      tags:
        - Config
      description: Update all of the IGA configuration properties, across all categories (currently only iga_access_request configuration is available.)  Note that all current configuration must be included when saving changes, any omitted keys will be replaced by default values.
      summary: Update all IGA configuration settings.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IGAConfig'
      responses:
        200:
          description: OK.
        400:
          description: Invalid settings or error saving.
        401:
          description: User is not authorized to use this endpoint.
  /commons/config/{key}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
      - name: key
        in: path
        required: true
        schema:
          type: string
    get:
      tags:
        - Config
      description: Reads and returns IGA configuration settings for a given category (e.g. iga_access_request.)
      summary: Get IGA configuration settings for a given category.
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/IGAAccessRequestConfig'
                - $ref: '#/components/schemas/IGAGlobalConfig'
              examples:
                iga_access_request:
                  value: {
                    "requireRequestJustification": true,
                    "requireRejectJustification": true,
                    "requireApproveJustification": true,
                    "preventRequestWithViolation": true,
                    "requireRequestJustificationWithViolation": true,
                    "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
                    "allowSelfApproval": true
                  }
                iga_global:
                  value: {
                    "enableScoping": false
                  }
                iga_autoid_integration:
                  value: {
                    "enableAutoId": false,
                    "highScorePercentThreshold": 82.30,
                    "mediumScorePercentThreshold": 54.00,
                    "lowScorePercentThreshold": 24.00,
                    "training_features_filter": [
                      "user.managerId"
                    ]
                  }
        400:
          description: IGA configuration settings cannot be read.

    put:
      tags:
        - Config
      description: Update IGA configuration settings for a given category (e.g. iga_access_request).
      summary: Update IGA configuration settings for a given category.
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - $ref: '#/components/schemas/IGAAccessRequestConfig'
              - $ref: '#/components/schemas/IGAGlobalConfig'
            examples:
              iga_access_request:
                value: {
                  "requireRequestJustification": true,
                  "requireRejectJustification": true,
                  "requireApproveJustification": true,
                  "preventRequestWithViolation": true,
                  "requireRequestJustificationWithViolation": true,
                  "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
                  "allowSelfApproval": true
                }
              iga_global:
                value: {
                  "enableScoping": false
                }
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                anyOf:
                - $ref: '#/components/schemas/IGAAccessRequestConfig'
                - $ref: '#/components/schemas/IGAGlobalConfig'
              examples:
                iga_access_request:
                  value: {
                    "requireRequestJustification": true,
                    "requireRejectJustification": true,
                    "requireApproveJustification": true,
                    "preventRequestWithViolation": true,
                    "requireRequestJustificationWithViolation": true,
                    "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
                    "allowSelfApproval": true
                  }
                iga_global:
                  value: {
                    "enableScoping": false
                  }
        400:
          description: Invalid settings or error saving.
        401:
          description: User is not authorized to use this endpoint.

  /governance/account:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Account
      summary: Search IGA for account objects.
      description: This endpoint is used to search IGA for account objects that have been on-boarded as part of any application.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
      responses:
        200:
          description: Success.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/AccountDetail'
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                    example: 1
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
                    example: 1
        400:
          description: Request error.
          content:
            application/json:
              schema:
                anyOf:
                  - type: object
    post:
      tags:
        - Account
      summary: Search IGA for account objects using additional filters.
      description: This endpoint is used to search IGA for account objects that have been on-boarded as part of any application.  Additional filter criteria can be provided to allow searching by application, user, or glossary data.
      parameters:
        - $ref: "#/components/parameters/allAccountAction"
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  properties:
                    targetFilter:
                      $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: Success.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/AccountDetail'
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                    example: 1
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
                    example: 1
        400:
          description: Request error.
          content:
            application/json:
              schema:
                anyOf:
                  - type: object

  /governance/account/{accountId}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Account
      description: Retrieve the details of a single account object using its unique identifier.
      summary: Get an account object by ID.
      parameters:
        - name: accountId
          in: path
          required: true
          description: The unique identifier of the account to get.
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountDetail'
        404:
          description: Request cannot be found.

  /governance/account/{accountId}/glossary:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Account
      description: Retrieve the glossary specific details of a single account object using its unique identifier.
      summary: Get an account's glossary metadata by ID.
      parameters:
        - name: accountId
          in: path
          required: true
          description: The unique identifier of the account to get glossary information for.
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountGlossaryDetail'
        404:
          description: Request cannot be found.
    post:
      tags:
        - Account
      description: Create glossary entry for a single account object using its unique identifier.
      summary: Create an account's glossary metadata by ID.
      parameters:
        - name: accountId
          in: path
          required: true
          description: The unique identifier of the account to get.
          schema:
            type: string
        - $ref: "#/components/parameters/allAccountGlossaryAction"
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/AccountGlossaryDetail'
      responses:
        200:
          description: Success.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountGlossaryDetail'
        400:
          description: Request error.
          content:
            application/json:
              schema:
                anyOf:
                  - type: object
    put:
      tags:
        - Account
      description: Create or update a glossary entry for a single account object using its unique identifier.
      summary: Create or update an account's glossary metadata by ID.
      parameters:
        - name: accountId
          in: path
          required: true
          description: The unique identifier of the account to get.
          schema:
            type: string
        - $ref: "#/components/parameters/allAccountGlossaryAction"
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/AccountGlossaryDetail'
      responses:
        200:
          description: Success.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountGlossaryDetail'
        400:
          description: Request error.
          content:
            application/json:
              schema:
                anyOf:
                  - type: object
  /governance/event:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Event
      description: Get and search for a list of event rules defined in IGA.  Each entry represents a single event rule that has been defined to detect a change in the system.  IGA rules consist of two core pieces, the condition for the event, and the action that should be taken when that event occurs.  For example, a rule may be defined that determines that any time a user is created in IGA, an certification for that user should be created.
      summary: Get event definitions.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/Event'
                  resultCount:
                    type: integer
                    description: Total number of items returned in this query.
                  totalCount:
                    type: integer
                    description: Total number of items matching the search criteria.
                  searchAfterKey:
                    type: array
                    description: List of terms used to properly paginate the next set of results in combination with the searchAfter parameter.
                    items:
                      type: string
        400:
          description: Error with request
          content: { }
        500:
          description: Server error
          content: { }
    post:
      tags:
        - Event
      description: Create a single IGA event rule.  A single event rule is defined to detect a change in the system.  IGA rules consist of two core pieces, the condition for the event, and the action that should be taken when that event occurs.  For example, a rule may be defined that determines that any time a user is created in IGA, an certification for that user should be created.
      summary: Create a new event definition.
      parameters:
        - $ref: "#/components/parameters/allEventAction"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EventPayload'
            examples:
              orchestration:
                value:
                  {
                    "name": "User Creation Event",
                    "description": "This event will kick off an orchestration for a new user upon creation.",
                    "entityType": "user",
                    "mutationType": "create",
                    "condition": {
                      "version": "v2",
                      "filter": {
                          "and": [
                              {
                                  "equals": {
                                      "left": "user.after.country",
                                      "right": {
                                          "literal": "USA"
                                      }
                                  }
                              }
                          ]
                      }
                    },
                    "action": {
                        "type": "orchestration",
                        "name": "IdentityCertificationKickOff"
                    },
                    "status": "active",
                    "owners": [
                        {
                            "id": "managed/user/02612d23-2f7e-4fd0-98f2-3c3d0988df27",
                            "mail": "aparsons@frgov.net",
                            "givenName": "Alvin",
                            "sn": "Parsons",
                            "userName": "aparsons"
                        }
                    ]
                  }
              certification:
                value:
                  {
                    "name": "User Creation Event - Certification",
                    "description": "This event will create an identity certification for a user upon creation.",
                    "entityType": "user",
                    "mutationType": "create",
                    "condition": {
                      "version": "v2",
                      "filter": {
                          "and": [
                              {
                                  "equals": {
                                      "left": "user.after.country",
                                      "right": {
                                          "literal": "USA"
                                      }
                                  }
                              }
                          ]
                      }
                    },
                    "action": {
                        "type": "certification",
                        "template": {
                            "name": "User Creation Event - Certification",
                            "description": "",
                            "stagingEnabled": false,
                            "schedule": null,
                            "skipInactiveCertifiers": false,
                            "allowSelfCertification": false,
                            "selfCertificationRule": "none",
                            "enableForward": true,
                            "enableReassign": true,
                            "reassignPermissions": {
                                "certify": true,
                                "comment": true,
                                "claim": true,
                                "exception": true,
                                "forward": true,
                                "reassign": true,
                                "reset": true,
                                "revoke": true,
                                "signoff": true
                            },
                            "exceptionDuration": 14,
                            "allowBulkCertify": true,
                            "allowPartialSignoff": false,
                            "remediationRule": null,
                            "initializeRule": "",
                            "finalizeRule": "",
                            "certificationType": "identity",
                            "ownerId": "managed/user/100a7fba-fd8b-47ca-bc6e-16fbec3a578d",
                            "stageDuration": 14,
                            "expirationAction": null,
                            "expirationActionDelay": 0,
                            "expirationReassignee": null,
                            "stages": [
                                {
                                    "certifierType": "user",
                                    "certifierId": "managed/user/100a7fba-fd8b-47ca-bc6e-16fbec3a578d",
                                    "certifierInfo": {
                                        "mail": "sandesh.more+sm-acc-api-1010@forgerock.com",
                                        "givenName": "iga",
                                        "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d",
                                        "sn": "admin",
                                        "userName": "iga-admin"
                                    }
                                }
                            ],
                            "defaultCertifierId": null,
                            "assignmentNotification": "emailTemplate/certificationAssigned",
                            "assignmentNotificationIncludeManager": false,
                            "reassignNotification": "emailTemplate/certificationReassigned",
                            "expirationNotification": null,
                            "reminderNotification": null,
                            "reminderFrequency": 0,
                            "escalationNotification": null,
                            "escalationFrequency": null,
                            "escalationOwner": null,
                            "remediationDelay": 0,
                            "targetFilter": {
                                "type": [
                                    "accountGrant",
                                    "entitlementGrant"
                                ],
                                "user": {
                                    "operator": "EQUALS",
                                    "operand": {
                                        "targetName": "id",
                                        "targetValue": "{{IGA_PARAM_userId_IGA_PARAM}}"
                                    }
                                },
                                "application": {
                                    "operator": "EQUALS",
                                    "operand": {
                                        "targetName": "authoritative",
                                        "targetValue": false
                                    }
                                },
                                "account": {
                                    "operator": "ALL",
                                    "operand": []
                                },
                                "entitlement": {
                                    "operator": "ALL",
                                    "operand": []
                                },
                                "decision": {
                                    "operator": "ALL",
                                    "operand": []
                                }
                            }
                        }
                    },
                    "status": "active",
                    "owners": [
                        {
                            "id": "managed/user/02612d23-2f7e-4fd0-98f2-3c3d0988df27",
                            "mail": "aparsons@frgov.net",
                            "givenName": "Alvin",
                            "sn": "Parsons",
                            "userName": "aparsons"
                        }
                    ]
                }
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
        400:
          description: Error with provided payload
          content: { }
        404:
          description: Event not found
          content: { }
        500:
          description: Server error
          content: { }
  /governance/event/{id}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Event
      description: Get a single IGA event by id.  The response is a single event rule that has been defined to detect a change in the system.
      summary: Get event definition by id.
      parameters:
        - name: id
          in: path
          description: ID of the event
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
        404:
          description: Event not found
          content: { }
        500:
          description: Server error
          content: { }
    put:
      tags:
        - Event
      description: Update a single IGA event by id.  This call expects the entire object to be provided and replace the entire existing event definition.
      summary: Update entire event definition by id.
      parameters:
        - name: id
          in: path
          description: ID of the event
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EventPayload'
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
        400:
          description: Error with provided payload
          content: { }
        404:
          description: Event not found
          content: { }
        500:
          description: Server error
          content: { }
    patch:
      tags:
        - Event
      description: Update a single IGA event by id.  This call will allow the caller to update specific properties of the event only, without providing the entire object.
      summary: Update specific properties of an event definition by id.
      parameters:
        - name: id
          in: path
          description: ID of the event
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples: 
              patchArray:
                value: [{ "operation" : "replace", "field" : "/status", "value" : "active" }]
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
        400:
          description: Error with provided payload
          content: { }
        404:
          description: Event not found
          content: { }
        500:
          description: Server error
          content: { }
    delete:
      tags:
        - Event
      description: Delete a single IGA event by id.
      summary: Delete a single IGA event by id.
      parameters:
        - name: id
          in: path
          description: ID of the event
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
        404:
          description: Event not found
          content: { }
        500:
          description: Server error
          content: { }
  /governance/event/entity:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Event
      description: Get the list of available entities on which a condition can be defined.
      summary: Get available event entities.
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConditionEntities'
        500:
          description: Server error
          content: { }
  /governance/event/entity/{object}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Event
      description: Get the available schema for defining a condition on a given object.  For example, 'user' will return the attributes available for defining an event for users in IGA.
      summary: Get schema for a given object.
      parameters:
        - name: object
          in: path
          description: Type of object for which to return schema
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConditionEntitySchema'
        404:
          description: Event rule schema not found
          content: { }
        500:
          description: Server error
          content: { }
  /governance/scope:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Scope
      description: Get and search for a list of scoping rules defined in IGA.  Each entry represents a single scoping rule that has been defined to assign a set of conditions that will allow a subset of users visibility on a subset of target objects.  IGA scoping rules consist of two core pieces, the condition for the source object (who/what the scope applies to), and the condition for the target objects that can be viewed/acted on/etc.
      summary: Get scope definitions.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/Scope'
                  resultCount:
                    type: integer
                    description: Total number of items returned in this query.
                  totalCount:
                    type: integer
                    description: Total number of items matching the search criteria.
                  searchAfterKey:
                    type: array
                    description: List of terms used to properly paginate the next set of results in combination with the searchAfter parameter.
                    items:
                      type: string
        400:
          description: Error with request
          content: { }
        500:
          description: Server error
          content: { }
    post:
      tags:
        - Scope
      description: Create a single scoping rule in IGA.  Each scoping rule is defined to assign a set of conditions that will allow a subset of users visibility on a subset of target objects.  IGA scoping rules consist of two core pieces, the condition for the source object (who/what the scope applies to), and the condition for the target objects that can be viewed/acted on/etc.
      summary: Create a new scope.
      parameters:
        - $ref: "#/components/parameters/allScopeAction"
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopePayload'
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Scope'
        400:
          description: Error with provided payload
          content: { }
        404:
          description: Scope not found
          content: { }
        500:
          description: Server error
          content: { }
  /governance/scope/{id}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Scope
      description: Get a single scoping rule in IGA by id.  Each scoping rule is defined to assign a set of conditions that will allow a subset of users visibility on a subset of target objects.  IGA scoping rules consist of two core pieces, the condition for the source object (who/what the scope applies to), and the condition for the target objects that can be viewed/acted on/etc.
      summary: Get scope by id.
      parameters:
        - name: id
          in: path
          description: ID of the scope
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Scope'
        404:
          description: Scope not found
          content: { }
        500:
          description: Server error
          content: { }
    put:
      tags:
        - Scope
      description: Update a single IGA scope by id.  This call expects the entire object to be provided and replace the entire existing scope definition.
      summary: Update entire scope by id.
      parameters:
        - name: id
          in: path
          description: ID of the scope
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ScopePayload'
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Scope'
        400:
          description: Error with provided payload
          content: { }
        404:
          description: Scope not found
          content: { }
        500:
          description: Server error
          content: { }
    patch:
      tags:
        - Scope
      description: Update a single IGA scope by id.  This call will allow the caller to update specific properties of the scope only, without providing the entire object.
      summary: Update specific properties of a scope by id.
      parameters:
        - name: id
          in: path
          description: ID of the scope
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples: 
              patchArray:
                value: [{ "operation" : "replace", "field" : "/status", "value" : "active" }]
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Scope'
        400:
          description: Error with provided payload
          content: { }
        404:
          description: Scope not found
          content: { }
        500:
          description: Server error
          content: { }
    delete:
      tags:
        - Scope
      description: Delete a single IGA scope by id.
      summary: Delete a single IGA scope by id.
      parameters:
        - name: id
          in: path
          description: ID of the scope
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Scope'
        404:
          description: Scope not found
          content: { }
        500:
          description: Server error
          content: { }
  /governance/scope/entity:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Scope
      description: Get the list of available entities on which a condition can be defined.
      summary: Get available scope entities.
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConditionEntities'
              example: {
                "entities": [
                  "user",
                  "catalog"
                ]
              }
        500:
          description: Server error
          content: { }
  /governance/scope/entity/{object}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Scope
      description: Get the available schema for defining a condition on a given object.  For example, 'user' will return the attributes available for defining a scope for users in IGA.
      summary: Get schema for a given object.
      parameters:
        - name: object
          in: path
          description: Type of object for which to return schema
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConditionEntitySchema'
              example:  {
                "schema": {
                  "user.userName": {
                    "class": "json",
                    "type": "string"
                  },
                  "user.description": {
                      "class": "json",
                      "type": "string"
                  },
                  "user._id": {
                      "class": "json",
                      "type": "string"
                  },
                  "user.givenName": {
                      "class": "json",
                      "type": "string"
                  },
                  "user.sn": {
                      "class": "json",
                      "type": "string"
                  }
                }
              }
        404:
          description: Scope schema not found
          content: { }
        500:
          description: Server error
          content: { }
  /governance/resource/{id}:
    get:
      tags:
        - Evolving
      summary: Get entitlement by ID
      description: The endpoint will return the entitlement with the provided ID.
      parameters:
        - name: id
          in: path
          description: ID of the entitlement
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SystemAssignment'
        404:
          description: Entitlement not found
          content: { }
        500:
          description: Server error
          content: { }
  /governance/resource/search:
    post:
      tags:
        - Evolving
      summary: Searches for entitlements that match query.
      description: Searches for all entitlements that match the target filter.
      parameters:
        - name: pageSize
          in: query
          description: Number of results per page
          schema:
            type: string
        - name: pageNumber
          in: query
          description: Page number of results to show
          schema:
            type: string
        - name: fields
          in: query
          description: Properties to be returned
          schema:
            type: string
        - name: sortBy
          in: query
          description: The property to be sorted by
          schema:
            type: string
        - name: sortDir
          in: query
          description: The direction of sort, asc or desc
          schema:
            type: string
        - name: sortType
          in: query
          description: The type of sort value, leave blank for normal sorting, or use 'date' or 'integer' for numeric
          schema:
            type: string
        - name: searchAfter
          in: query
          description: The sort property values of the last entry to continue searching from. Comma separated.
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        201:
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/SystemAssignment'
                  resultCount:
                    type: integer
                    description: Total number of items returned in this query.
                  totalCount:
                    type: integer
                    description: Total number of items matching the search criteria.
                  searchAfterKey:
                    type: array
                    description: List of terms used to properly paginate the next set of results in combination with the searchAfter parameter.
                    items:
                      type: string
        400:
          description: Invalid request.
          content: { }
        500:
          description: Server error
          content: { }
  /governance/resource/{id}/assignments/user:
    get:
      tags:
        - Evolving
      summary: Returns users assigned the given entitlement
      description: This end point returns users assigned the given entitlement
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the application
          schema:
            type: string
        - name: pageSize
          in: query
          description: Number of results per page
          schema:
            type: string
        - name: pageNumber
          in: query
          description: Page number of results to show
          schema:
            type: string
        - name: sortBy
          in: query
          description: Field to sort by
          schema:
            type: string
        - name: sortDesc
          in: query
          description: Sort order asc/desc
          schema:
            type: string
        - name: queryString
          in: query
          description: Search term, searches against userName, givenName, sn
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                description: The content of the object is depended on what are available from the external system
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        user:
                          type: object
                          description: The user info
                          properties:
                            id:
                              type: string
                              description: The ID of the user
                            userName:
                              type: string
                            givenName:
                              type: string
                              description: First name
                            sn:
                              type: string
                              description: Last name
                            mail:
                              type: string
                              description: Email address
                        account:
                          type: object
                          description: The account information for the account that has this entitlement
                        item:
                          type: object
                          description: Information describing the specific grant, e.g. type, last certified, etc.
                        relationship:
                          type: object
                          description: Information on the IDM relationship that defines this grant
                  resultCount:
                    type: integer
                    description: Total number of items returned in this query.
                  totalCount:
                    type: integer
                    description: Total number of items matching the search criteria.
                  searchAfterKey:
                    type: array
                    description: List of terms used to properly paginate the next set of results in combination with the searchAfter parameter.
                    items:
                      type: string
        500:
          description: Server error
  /governance/requestForms:
    get:
      tags:
        - Request Form
      summary: Search request forms
      description: This endpoint is used to search request forms
      parameters:
        - name: _queryFilter
          in: query
          required: false
          description: The search query filter
          schema:
            type: string
        - name: _fields
          in: query
          required: false
          description: The list of fields to return for each entry in the response result. Comma-separated for multiple values.
          schema:
            type: string
        - name: _pagedResultsOffset
          in: query
          required: false
          description: Offset number of the record from which to start the paginated results.
          schema:
            type: integer
        - name: _pageSize
          in: query
          required: false
          description: Number of response result objects to return.
          schema:
            type: integer
        - name: _sortKeys
          in: query
          required: false
          description: The property on which to sort the results.
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestForm"
    post:
      tags:
        - Request Form
      summary: Create request form
      description: This endpoint is used to create a request form
      requestBody:
        description: The payload for create request form
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RequestForm"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestForm"
  /governance/requestForms/{id}:
    get:
      tags:
        - Request Form
      summary: Get request form by ID
      description: This endpoint is used to get request form by ID
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the request form
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestForm"
        404:
          description: Request form not found
    put:
      tags:
        - Request Form
      summary: Replace request form
      description: This endpoint is used to replace an existing request form
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the request form
          schema:
            type: string
      requestBody:
        description: The payload for replacing request form
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RequestForm"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestForm"
    patch:
      tags:
        - Request Form
      summary: Update request form
      description: This endpoint is used to update an existing request form
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the request form
          schema:
            type: string
      requestBody:
        description: The payload for replacing request form
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PatchPayload"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestForm"
  /governance/requestFormAssignments:
    get:
      tags:
        - Request Form
      summary: Search request form assignments
      description: The endpoint is used to search the assignment of request forms
      parameters:
        - name: _queryFilter
          in: query
          required: false
          description: The search query filter
          schema:
            type: string
        - name: _fields
          in: query
          required: false
          description: The list of fields to return for each entry in the response result. Comma-separated for multiple values.
          schema:
            type: string
        - name: _pagedResultsOffset
          in: query
          required: false
          description: Offset number of the record from which to start the paginated results.
          schema:
            type: integer
        - name: _pageSize
          in: query
          required: false
          description: Number of response result objects to return.
          schema:
            type: integer
        - name: _sortKeys
          in: query
          required: false
          description: The property on which to sort the results.
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestFormAssignment"
    post:
      tags:
        - Request Form
      summary: Assign and unassign request form
      description: The endpoint is used to assign and unassign request form
      parameters:
        - name: _action
          in: query
          required: true
          schema: 
            type: string
            enum: [assign, unassign]
      requestBody:
        description: The payload for assign or unassign request form
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RequestFormAssignment"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestFormAssignment"
  /governance/user/{userId}/tasks:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - Task
      summary: Get tasks user has permissions to view.
      description: Get the tasks for which the authenticated user has permissions to view.
      parameters:
        - $ref: "#/components/parameters/userIdForTasks"
        - $ref: "#/components/parameters/userTaskType"
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                     anyOf:
                      - $ref: "#/components/schemas/AccessRequestDetail"
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
    post:
      tags:
        - Task
      summary: Get tasks user has permissions to view.
      description: Get the tasks for which the authenticated user has permissions to view. The targetFilter property in the API payload can be used to filter the requests based on the desired criteria.
      requestBody:
        content:
          '*/*':
            schema:
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      parameters:
        - $ref: "#/components/parameters/userTasksAction"
        - $ref: "#/components/parameters/userIdForTasks"
        - $ref: "#/components/parameters/userTaskType"
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                     anyOf:
                      - $ref: "#/components/schemas/AccessRequestDetail"
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
  /governance/user/{userId}/grants:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - User
      summary: Get the grants a user currently has.
      description: Get the different grants for which the given user currently has, including roles, accounts or entitlements.
      parameters:
        - $ref: "#/components/parameters/userId"
        - name: queryString
          in: query
          description: Search term, searches against display names of the grant being targeted.
          schema:
            type: string
        - name: grantType
          in: query
          description: Type of grant being searched for.
          schema:
            type: string
            enum: [ entitlement, account, role ]
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                properties:
                  result:
                    type: array
                    items:
                     anyOf:
                      - $ref: "#/components/schemas/AccessGrant"
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
  /governance/user/{userId}/recommendations:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
        - User
      summary: Get the access recommendations for a given a user.
      description: Get the recommendations provided by Auto ID for the access that a user should have.
      parameters:
        - $ref: "#/components/parameters/userId"
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                     anyOf:
                      - $ref: "#/components/schemas/AutoIdRecommendation"
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.

  /governance/jobs/{id}:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Job
      description: Trigger an IGA job by ID.
      summary: Manually triggers one of IGA's job processes.
      parameters:
        - name: id
          in: path
          description: ID of the scope
          required: true
          schema:
            type: string
            enum: [ autoIdTraining ]
        - name: _action
          in: query
          description: Action to be taken
          required: true
          schema:
            type: string
            enum: [ trigger ]
      requestBody:
        content:
          application/json:
            schema:
              type: object
      responses:
        200:
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    description: 'Message indicationg success'
        400:
          description: Bad Request
        500:
          description: Internal Service Error
        404:
          description: Workflow with ID was not found.
  /governance/audit:
    get:
      tags:
      - Audit
      description: Get audit reports
      summary: Get audit reports
      parameters:
      - name: objectId
        in: query
        description: Id of the object to retrieve report.
        schema:
          type: string
      - name: startDate
        in: query
        description: First date to inlcude in the report
        schema:
          type: string
      - name: endDate
        in: query
        description: Last date to inlcude in the report
        schema:
          type: string
      - name: queryId
        in: query
        description: Required parameter for pagination, use value from previous response.
        schema:
          type: string
      - name: dataSetId
        in: query
        description: Required parameter for pagination, use value from previous response.
        schema:
          type: string
      - name: _pagedResultCookie
        in: query
        description: Used for pagination of results.
        schema:
          type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReportResult'
  /governance/user/{userId}/audit:
    get:
      tags:
      - Audit
      description: Get audit reports for user.
      summary: Get audit reports for user.
      parameters:
      - name: userId
        in: path
        description: Id of the user to retrieve report.
        schema:
          type: string
        required: true
      - name: queryId
        in: query
        description: Required parameter for pagination, use value from previous response.
        schema:
          type: string
      - name: dataSetId
        in: query
        description: Required parameter for pagination, use value from previous response.
        schema:
          type: string
      - name: _pagedResultCookie
        in: query
        description: Used for pagination of results.
        schema:
          type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ReportResult'
      
        400:
          description: Error with provided payload
          content: { }
        404:
          description: Job not found
          content: { }
        500:
          description: Server error
          content: { }
  /governance/certification/template:
    get:
      tags:
        - Certification
      summary: Query existing certification templates.
      description: Returns certification templates, based on a set of query parameters.
      parameters:
        - name: queryString
          in: query
          description: String to search against name and description.
          schema:
            type: string
        - name: pageSize
          in: query
          description: Number of results per page.
          schema:
            type: string
        - name: pageNumber
          in: query
          description: Page number of results to show.
          schema:
            type: string
        - name: searchAfter
          in: query
          required: false
          description: An alternate of page number, corresponds to the searchAfterKey value sent in previous page's results.
          schema:
            type: string
        - name: sortBy
          in: query
          description: Property to sort results by.
          schema:
            type: string
        - name: sortDesc
          in: query
          description: Direction to sort results by.
          schema:
            type: string
        - name: certificationType
          in: query
          description: Filter by certification type.
          schema:
            type: string
            enum:
              - "identity"
              - "roleMembership"
              - "entitlement"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CertificationTemplate'
        400:
          description: Invalid request.
        500:
          description: Server error.
    post:
      tags:
        - Certification
      summary: Create a new certification template.
      description: Creates a new certification template based on the given payload.
      requestBody:
        description: The contents of the new template.
        content:
          '*/*':
            schema:
              $ref: '#/components/schemas/CertificationTemplateCreation'
            example: {
              "name":"Active Directory Certification",
              "description":"Certifying the accounts within active directory applications",
              "stagingEnabled":false,
              "schedule":null,
              "allowSelfCertification":false,
              "selfCertificationRule":"none",
              "enableForward":true,
              "enableReassign":true,
              "reassignPermissions":{
                  "certify":true,
                  "comment":true,
                  "exception":true,
                  "forward":true,
                  "reassign":true,
                  "reset":true,
                  "revoke":true,
                  "signoff":true
              },
              "exceptionDuration":7,
              "allowBulkCertify":true,
              "allowPartialSignoff":true,
              "remediationRule":"",
              "certificationType":"identity",
              "ownerId":"managed/user/926de311-0949-415d-a9e4-94a87632b0f6",
              "stageDuration":14,
              "expirationAction":"revoke",
              "expirationActionDelay":0,
              "expirationReassignee":null,
              "stages":[
                  {
                    "certifierType":"user",
                    "certifierId":"managed/user/79cc9f29-8d89-4958-8074-ce0df88979a2"
                  }
              ],
              "defaultCertifierId":null,
              "assignmentNotification":null,
              "reassignNotification":null,
              "expirationNotification":null,
              "reminderNotification":null,
              "reminderFrequency":0,
              "escalationNotification":null,
              "escalationFrequency":null,
              "escalationOwner":null,
              "remediationDelay":0,
              "targetFilter":{
                  "user":{
                    "operator":"ALL",
                    "operand":[
                        
                    ]
                  },
                  "type":[
                    "accountGrant"
                  ],
                  "application":{
                    "operator":"CONTAINS",
                    "operand":{
                      "targetName": "name",
                      "targetValue": "Active Directory"
                    }
                  }
              },
              "excludeConditionalAccess": true,
              "excludeRoleBasedAccess": true,
              "includeChildOrganizations": true
            }
        required: true
      responses:
        201:
          description: Creation success, returns the saved Template object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificationTemplate'
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/template/{id}/duplicate:
    post:
      tags:
        - Certification
      summary: Duplicate an existing certification template.
      description: Takes the definition of an existing certification template and makes a copy of it.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the template object to copy.
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema: 
                $ref: '#/components/schemas/TemplateDuplicateReturn'
                
        400:
          description: Invalid request.
          content: {}
        404:
          description: Template not found.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/template/{id}:
    put:
      tags:
        - Certification
      summary: Update a single certification template.
      description: Updates a certification template at the requested id in the path.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the template object.
          schema:
            type: string
      requestBody:
        description: The template fields to update.
        content:
          '*/*':
            schema:
              $ref: '#/components/schemas/CertificationTemplateCreation'
        required: false
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CertificationTemplate'
        400:
          description: Invalid request.
          content: {}
        404:
          description: Template not found
          content: {}
        500:
          description: Server error.
          content: {}
    delete:
      tags:
        - Certification
      summary: Delete a single certification template.
      description: Deletes a certification template at the requested id in the path.  Does not remove traceability as campaign instances of the template copy over its contents when created into a campaign.
      parameters:
        - name: id
          in: path
          required: true
          description: ID of the template object.
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CertificationTemplate'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/get-filter-schema:
    post:
      tags:
        - Certification
      summary: Get the available schema on which to filter certification templates
      description: Returns a collection of schema properties that are available to populate the certification template's target filter property, including properties of application, user, entitlement, role, and other objects.
      responses:
        200:
          description: OK
          content:
            application/json:
              schema: 
                $ref: '#/components/schemas/TemplateDuplicateReturn'
              example: {
                "application": [
                    {
                        "key": "application.description",
                        "name": "description",
                        "displayName": "Description",
                        "description": "Application Description",
                        "type": "string",
                        "isMultiValue": false
                    },
                    {
                        "key": "application.name",
                        "name": "name",
                        "displayName": "Name",
                        "description": "Application name",
                        "type": "string",
                        "isMultiValue": false
                    }
                ],
                "entitlement": [
                    {
                        "key": "glossary.idx./entitlement.description",
                        "allowedValues": [],
                        "isIndexed": true,
                        "isMultiValue": false,
                        "managedObjectType": null,
                        "searchable": true,
                        "isInternal": true,
                        "displayName": "Description",
                        "name": "description",
                        "description": "Description of entitlement",
                        "objectType": "/openidm/managed/assignment",
                        "type": "string"
                    },
                    {
                        "key": "entitlement.displayName",
                        "name": "displayName",
                        "displayName": "Display Name",
                        "description": "",
                        "type": "text",
                        "isMultiValue": false
                    },
                    {
                        "key": "glossary.idx./entitlement.entitlementOwner",
                        "allowedValues": [],
                        "isIndexed": true,
                        "isMultiValue": false,
                        "managedObjectType": "/openidm/managed/user",
                        "searchable": true,
                        "isInternal": true,
                        "displayName": "Entitlement Owner",
                        "name": "entitlementOwner",
                        "description": "Entitlement Owner of Object",
                        "objectType": "/openidm/managed/assignment",
                        "type": "managedObject"
                    },
                    {
                        "key": "glossary.idx./entitlement.requestable",
                        "allowedValues": [],
                        "isIndexed": true,
                        "isMultiValue": false,
                        "managedObjectType": null,
                        "searchable": true,
                        "isInternal": true,
                        "displayName": "Requestable",
                        "name": "requestable",
                        "description": "Can the entitlement be requested",
                        "objectType": "/openidm/managed/assignment",
                        "type": "boolean"
                    }
                ],
                "role": [
                    {
                        "key": "role.applications._ref",
                        "name": "applications",
                        "displayName": "Applications",
                        "description": "Role Applications",
                        "type": "managedObject",
                        "isMultiValue": true,
                        "managedObjectType": "/openidm/managed/alpha_application"
                    },
                    {
                        "key": "role.description",
                        "name": "description",
                        "displayName": "Description",
                        "description": "The role description, used for display purposes.",
                        "type": "string",
                        "isMultiValue": false
                    },
                    {
                        "key": "role.id",
                        "name": "_id",
                        "displayName": "Name",
                        "description": "Role ID",
                        "type": "string",
                        "isMultiValue": false
                    },
                    {
                        "key": "role.name",
                        "name": "name",
                        "displayName": "Name",
                        "description": "The role name, used for display purposes.",
                        "type": "string",
                        "isMultiValue": false
                    },
                    {
                        "key": "glossary.idx./role.requestable",
                        "allowedValues": [],
                        "isIndexed": true,
                        "isMultiValue": false,
                        "managedObjectType": null,
                        "searchable": true,
                        "isInternal": true,
                        "displayName": "Requestable",
                        "name": "requestable",
                        "description": "Can the role be requested",
                        "objectType": "/openidm/managed/role",
                        "type": "boolean"
                    },
                    {
                        "key": "role.members._ref",
                        "name": "members",
                        "displayName": "Role Members",
                        "description": "Role Members",
                        "type": "managedObject",
                        "isMultiValue": true,
                        "managedObjectType": "/openidm/managed/alpha_user"
                    }
                ]
              }
        400:
          description: Invalid request.
          content: {}
        404:
          description: Template not found.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/admin/certification:
    get:
      tags:
        - Certification
      summary: Query existing certification campaign instances.
      description: Returns certification campaigns based on a set of query parameters.
      parameters:
        - name: queryString
          in: query
          description: String to search against name and description.
          schema:
            type: string
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
        - name: status
          in: query
          description: Filter by status of the certification.
          schema:
            type: string
            enum:
              - "active"
              - "closed"
        - name: certificationType
          in: query
          description: Filter by certification type.
          schema:
            type: string
            enum:
              - "identity"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/Certification'
                  totalHits:
                    type: integer
                    description: Total number of items matching the search criteria.
                  searchAfterKey:
                    type: array
                    description: List of terms used to properly paginate the next set of results in combination with the searchAfter parameter.
                    items:
                      type: string

        400:
          description: Invalid request.
        500:
          description: Server error.
  /governance/admin/certification/{certId}:
    get:
      tags:
        - Certification
      summary: Read a single certification campaign
      description: Returns the certification campaign from the provided campaign id.
      parameters:
        - name: certId
          in: path
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificationSingle'
        404:
          description: Certification not found.
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/admin/certification/{certId}/tasks:
    get:
      tags:
        - Certification
      summary: Get the actors (certifiers) tasks view for a certification.
      description: Returns the tasks assigned to different actors (certifiers) as part of a certification.
      parameters:
        - name: certId
          in: path
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
        - name: queryString
          in: query
          description: Search tasks based on reviewer information (userName, sn, givenName, mail)
          schema:
            type: string
        - name: pageSize
          in: query
          description: Number of results per page.
          schema:
            type: string
        - name: pageNumber
          in: query
          description: Page number of results to show.
          schema:
            type: string
        - name: sortBy
          in: query
          description: Term on which to sort tasks (e.g. actor.userName, progress)
          schema:
            type: string
        - name: sortDir
          in: query
          description: Direction on which to sort ('asc' or 'desc')
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        actor:
                          type: object
                          properties:
                            id:
                              type: string
                              description: ID of actor.
                            givenName:
                              type: string
                              description: Given name of actor (certifier), when user.
                            sn:
                              type: string
                              description: Surname of actor (certifier), when user.
                            userName:
                              type: string
                              description: User name of actor (certifier), when user.
                            type:
                              type: string
                              description: Type of actor. Can either be a user or a role that exists.
                              enum:
                                - user
                                - role
                            name:
                              type: string
                              description: Name of actor, when role.
                            key:
                              type: string
                              description: Full path of actor id, for example, managed/user/id.
                        inProgress:
                          type: integer
                          description: Number of decision items in progress for this actor.
                        complete:
                          type: integer
                          description: Number of decision items signed off for this actor.
                        total:
                          type: integer
                          description: Total number of decision items for this actor.
                        progress:
                          type: integer
                          description: Percentage of items that have decisions made (between 0.0 and 1.0)
                        status:
                          type: string
                          description: Status of the user's work.
                          enum:
                            - staging
                            - in-progress
                            - complete
                            - expired
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/{certId}/update-deadline:
    post:
      tags:
        - Certification
      summary: Update a certification's deadline.
      description: Update a certification's deadline when you provide a new one.
      parameters:
        - name: certId
          in: path
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                newDeadline:
                  type: string
                  description: New deadline to update.
              example:
                {
                  "newDeadline": "2023-05-01T12:00:00+00:00"
                }
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificationSingle'
        400:
          description: Invalid request.
          content: {}
        404:
          description: Certificaiton could not be found.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/{certId}/cancel:
    post:
      tags:
        - Certification
      summary: Cancel a certification campaign.
      description: Cancels a certification campaign at the requested id in the path. This only cancels existing in-progress action items. It will not revert any decisions that have been signed-off and acted on.
      parameters:
        - name: certId
          in: path
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Certification'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/items:
    get:
      tags:
        - Certification
      summary: Query the review items/tasks that are assigned to you
      description: Returns the certification tasks that are currently assigned to the logged in end-user.
      parameters:
        - name: status
          in: query
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
            enum:
            - active
            - expired
            - complete
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                properties:
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/CampaignTask'
                  totalCount:
                    type: integer
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/{certId}/items:
    get:
      tags:
        - Certification
      summary: Query line items of the certification campaign instance
      description: Returns the certification line-items that belong to this campaign, filtered by parameters. Certifier sign-off is indicated by status. The certifier's decision is indicated by decision.
      parameters:
        - name: certId
          in: path
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
        - name: targetId
          in: query
          required: false
          description: ID of the target of the line-item.
          schema:
            type: string
        - name: pageSize
          in: query
          required: false
          description: Number of items to return.
          schema:
            type: string
        - name: pageNumber
          in: query
          required: false
          description: Page number of results to return.
          schema:
            type: string
        - name: searchAfter
          in: query
          required: false
          description: An alternate of page number, corresponds to the searchAfterKey value sent in previous page's results.
          schema:
            type: string
        - name: status
          in: query
          required: false
          description: Status of the line-item.
          schema:
            type: string
            enum:
              - in-progress
              - signed-off
              - pending
              - cancelled
              - expired
        - name: decision
          in: query
          required: false
          description: Decision taken on the line-item.
          schema:
            type: string
            enum:
              - certify
              - revoke
              - exception
              - abstain
        - name: ownerId
          in: query
          required: false
          description: ID of the owner of the line-item.
          schema:
            type: string
        - name: user
          in: query
          required: false
          description: ID of the user the line-item(s) are certifying,
          schema:
            type: string
        - name: resource
          in: query
          required: false
          description: ID of the resource the line-item(s) are certifying.
          schema:
            type: string
        - name: application
          in: query
          required: false
          description: ID of the application the line-items(s) are certifying.
          schema:
            type: string
        - name: actorId
          in: query
          required: false
          description: ID of any actor (certifier) in the line-items actor list.
          schema:
            type: string
        - name: primaryReviewerId
          in: query
          required: false
          description: ID of the primary reviewer/certifier of the line-items.
          schema:
            type: string
        - name: user.userName
          in: query
          required: false
          description: Username of the user the line-item(s) are certifying.
          schema:
            type: string
        - name: itemType
          in: query
          required: false
          description: Item type of the line-item.
          schema:
            type: string
            enum:
              - Account Grant
              - Resource Grant
        - name: account
          in: query
          required: false
          description: ID of the account the line-items(s) are certifying.
          schema:
            type: string
        - name: groupBy
          in: query
          required: false
          description: Aggregates the results to allow the frontend to group line-items.
          schema:
            type: string
        - name: appendUserPermissions
          in: query
          required: false
          description: Appends the logged in user permissions for each line-item. Used by frontend.
          schema:
            type: boolean
        - name: taskStatus
          in: query
          required: false
          description: Task level alternative to status (which is item level).
          schema:
            type: string
            enum:
              - active
              - complete
              - closed
              - cancelled
              - expired
        - name: getCount
          in: query
          required: false
          description: If true, will return the line item count based on the query.
          schema:
            type:  boolean
        - name: isAdmin
          in: query
          required: false
          description: If true and if the user has permission it will return the results as an admin.
          schema:
            type:  boolean
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/CertificationLineItem'
                  resultCount:
                    type: integer
                    description: Total number of items returned in this query.
                  totalHits:
                    type: integer
                    description: Total number of items matching the search criteria.
                  searchAfterKey:
                    type: array
                    description: List of terms used to properly paginate the next set of results in combination with the searchAfter parameter.
                    items:
                      type: string
        400:
          description: Invalid request.
          content: {}
        404:
          description: ID or value sent in parameters was not found.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/{certId}/items/search:
    post:
      tags:
        - Certification
      summary: Query line-items of the certification campaign instance.
      description: Returns the certification line-items that belong to the specified campaign, filtered by parameters.
      parameters:
        - name: certId
          in: path
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_sortType"
        - $ref: "#/components/parameters/_searchAfter"
        - name: appendUserPermissions
          in: query
          required: false
          description: Appends the logged in user permissions for each line-item.
          schema:
            type: boolean
        - name: taskStatus
          in: query
          required: false
          description: Task level status search.
          schema:
            type: string
            enum:
              - active
              - complete
              - closed
              - cancelled
              - expired
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
            example: {
              "targetFilter": {
                  "operator": "AND",
                  "operand": [
                      {
                          "operator": "EQUALS",
                          "operand": {
                              "targetName": "decision.certification.primaryReviewer.id",
                              "targetValue": "managed/user/c1147059-b6ab-4cf6-937c-b93202c6cec8"
                          }
                      },
                      {
                          "operator": "EQUALS",
                          "operand": {
                              "targetName": "item.type",
                              "targetValue": "accountGrant"
                          }
                      }
                  ]
              }
          }
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      $ref: '#/components/schemas/CertificationLineItem'
                  resultCount:
                    type: integer
                    description: Total number of items returned in this query.
                  totalCount:
                    type: integer
                    description: Total number of items matching the search criteria.
                  searchAfterKey:
                    type: array
                    description: List of terms used to properly paginate the next set of results in combination with the searchAfter parameter.
                    items:
                      type: string
        400:
          description: Invalid request.
          content: {}
        404:
          description: ID or value sent in parameters was not found.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/{certId}/items/{action}:
    post:
      tags:
        - Certification
      summary: Take action on line-items
      description: Action taken on the given lineItems
      parameters:
        - name: certId
          in: path
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
        - name: action
          in: path
          required: true
          description: The specific action to take
          schema:
            type: string
            enum: [ 'certify', 'revoke', 'exception', 'comment', 'forward', 'signoff']
        - name: selectAllActorId
          in: query
          required: false
          description: When provided, the action will target all decision items the given actor is the primary reviewer for, and ids array can be left empty.
          schema:
            type: string
      requestBody:
        description: Contents of the action.
        content:
          '*/*':
            schema:
              required: [ ids ]
              properties:
                ids:
                  type: array
                  items:
                    type: string
            examples:
              certify:
                value: {
                  "ids": [
                    "e9e4d260-1b55-4331-8468-5824344b8bc3",
                    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
                  ]
                }
              revoke:
                value: {
                  "ids": [
                    "e9e4d260-1b55-4331-8468-5824344b8bc3",
                    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
                  ],
                  "comment": "No longer needs this access."
                }
              exception:
                value: {
                  "ids": [
                    "e9e4d260-1b55-4331-8468-5824344b8bc3",
                    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
                  ],
                  "comment": "May need this access for a few days longer"
                }
              comment:
                value: {
                  "ids": [
                    "e9e4d260-1b55-4331-8468-5824344b8bc3",
                    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
                  ],
                  "comment": "Checking with user's manager on this decision."
                }
              reassign:
                value: {
                  "ids": [
                    "e9e4d260-1b55-4331-8468-5824344b8bc3",
                    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
                  ],
                 "newActorId":"managed/user/b186098e-413b-47e8-a5f2-5b49ba040adb",
                 "permissions":{
                    "certify":true,
                    "revoke":true,
                    "exception":true,
                    "reset":true,
                    "comment":true,
                    "reassign":true,
                    "forward":true,
                    "signoff":true
                 }
              }
              forward:
                value: {
                  "ids": [
                    "e9e4d260-1b55-4331-8468-5824344b8bc3",
                    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
                  ],
                  "comment": "This should be reviewed by you.",
                  "newActorId": "managed/user/c1147059-b6ab-4cf6-937c-b93202c6cec8"
                }
              signoff:
                value: {
                  "ids": [],
                  "actorId": "managed/user/c1147059-b6ab-4cf6-937c-b93202c6cec8"
                }
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LineItemActionMessage'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/certification/{certId}/items/{lineItemId}/{action}:
    post:
      tags:
        - Certification
      summary: Take action on a single item
      description: Take action on a single item.
      parameters:
        - name: certId
          in: path
          required: true
          description: ID of the certification campaign.
          schema:
            type: string
        - name: lineItemId
          in: path
          required: true
          description: ID of the line item.
          schema:
            type: string
        - name: action
          in: path
          required: true
          description: The specific action to take
          schema:
            type: string
            enum: [ 'certify', 'revoke', 'exception', 'comment', 'reassign', 'forward']
      requestBody:
        description: Contents of the action.
        content:
          'application/json':
            schema:
              type: object
            examples:
                certify:
                  value: {
                  }
                revoke:
                  value: {
                    "comment": "No longer needs this access."
                  }
                exception:
                  value: {
                    "comment": "May need this access for a few days longer"
                  }
                comment:
                  value: {
                    "comment": "Checking with user's manager on this decision."
                  }
                reassign:
                  value: {
                   "newActorId":"managed/user/b186098e-413b-47e8-a5f2-5b49ba040adb",
                   "permissions":{
                      "certify":true,
                      "revoke":true,
                      "exception":true,
                      "reset":true,
                      "comment":true,
                      "reassign":true,
                      "forward":true,
                      "signoff":true
                   }
                }
                forward:
                  value: {
                    "comment": "This should be reviewed by you.",
                    "newActorId": "managed/user/c1147059-b6ab-4cf6-937c-b93202c6cec8"
                  }
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LineItemActionMessage'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error.
          content: {}
  /governance/policy:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Segregation of Duty
      summary: Query policies
      description: The endpoint will return policies stored within the IGA store, based on a set of query parameters.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Policy'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    post:
      tags:
      - Segregation of Duty
      summary: Create a new policy
      description: The end point will allow for creation of a new policy object within IGA.
      parameters:
        - $ref: "#/components/parameters/allPolicyAction"
      requestBody:
        description: The contents of the new policy
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyRequest'
        required: true
      responses:
        201:
          description: Creation success, returns the saved Policy object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}     
  /governance/policy/search:         
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Search policy objects
      description: Query the policy objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Policy'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}           
  /governance/policy/{id}:            
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Segregation of Duty
      summary: Get policy by ID
      description: The endpoint will return the policy with the provided ID.
      parameters:
      - name: id
        in: path
        description: ID of the policy
        required: true
        schema:
          type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}      
    put:
      tags:
      - Segregation of Duty
      summary: Update an existing policy object
      description: The end point will allow for updating an existing policy object within IGA.
      parameters:
      - name: id
        in: path
        description: ID of the policy to update
        required: true
        schema:
          type: string
      requestBody:
        description: The contents of the updated policy
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyBody'
        required: false
      responses:
        200:
          description: Update success, returns the saved policy object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
    delete:
      tags:
      - Segregation of Duty
      summary: Delete an existing policy
      description: The end point will allow for deleting an existing policy object within IDM.
      parameters:
      - name: id
        in: path
        description: ID of the policy to delete
        required: true
        schema:
          type: string
      responses:
        200:
          description: Delete success, returns the removed policy object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Policy'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}        
  /governance/policy/{id}/scan:        
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Scan the given policy for violations
      description: The end point will run a scan on all of the given rules of a policy, and create violations if desired.
      parameters:
      - name: id
        in: path
        description: ID of the policy to scan
        required: true
        schema:
          type: string
      - name: simulate
        in: query
        description: Whether or not this scan is a simulation, true means no violation tasks will be created, false or not present will create violations.
        required: false
        schema:
          type: string
      - name: waitForCompletion
        in: query
        description: Whether or not to await the completion of the scan before returning, true will wait, false or not present will return after scan creation.
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
        required: false
      responses:
        201:
          description: Policy scan started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}    
  /governance/policy/{id}/rules:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"     
    get:
      tags:
      - Segregation of Duty
      summary: Get policy rules
      description: Given Policy ID, retrieve the policy rules associated with it.
      parameters:
      - name: id
        in: path
        description: ID of the policy
        required: true
        schema:
          type: string
      - $ref: "#/components/parameters/_pageSize"
      - $ref: "#/components/parameters/_pagedResultsOffset"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRulesResult'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/rule:          
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"     
    get:
      tags:
      - Segregation of Duty
      summary: Query policy rules
      description: The endpoint will return policy rules stored within the IGA store, based on a set of query parameters.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyRule'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}  
    post:
      tags:
      - Segregation of Duty
      summary: Create a new policy rule
      description: The end point will allow for creation of a new policy rule object within IGA.
      parameters:
        - $ref: "#/components/parameters/allPolicyAction"
      requestBody:
        description: The contents of the new policy rule
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyRuleBody'
        required: true
      responses:
        201:
          description: Creation success, returns the saved Policy Rule object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRule'
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/rule/search: 
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"  
    post:
      tags:
      - Segregation of Duty
      summary: Search policy rules
      description: Query the policy rule objects using a targeted search filter    
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyRule'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}         
  /governance/policy/rule/{id}:        
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"  
    get:
      tags:
      - Segregation of Duty
      summary: Get policy rule by ID
      description: The endpoint will return the policy rule with the provided ID.
      parameters:
      - name: id
        in: path
        description: ID of the policy rule
        required: true
        schema:
          type: string
      - name: resolveSchemas
        in: query
        description: When 'true', enrich the remediation.schemas property with the full schema objects rather than just the IDs
        required: false
        schema:
          type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRule'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    post:
      tags:
      - Segregation of Duty
      summary: Duplicate the given policy rule
      description: Creates a duplicate of the selected policy rule.
      parameters:
      - $ref: "#/components/parameters/allPolicyAction"  
      - name: id
        in: path
        description: ID of the policy rule
        required: true
        schema:
          type: string
      requestBody:
        description: The contents of the duplicate request (empty body)
        content:
          application/json:
            schema:
              type: object
        required: false
      responses:
        201:
          description: Returns new policy rule. Note rule will be set as inactive by default.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRuleBody'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}   
    put:
      tags:
      - Segregation of Duty
      summary: Update an existing policy rule object
      description: The end point will allow for updating an existing policy rule object within IGA.
      parameters:
      - name: id
        in: path
        description: ID of the policy rule to update
        required: true
        schema:
          type: string
      requestBody:
        description: The contents of the updated policy rule
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyRuleBody'
        required: false
      responses:
        200:
          description: Update success, returns the saved policy rule object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRule'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
    delete:
      tags:
      - Segregation of Duty
      summary: Delete an existing policy rule
      description: The end point will allow for deleting an existing policy rule object within IDM.
      parameters:
      - name: id
        in: path
        description: ID of the policy rule to delete
        required: true
        schema:
          type: string
      responses:
        200:
          description: Delete success, returns the removed policy rule object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyRule'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {} 
  /governance/policy/rule/{id}/scan:       
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Scan the given policy for violations
      description: The end point will run a scan on the given policy rule, and create violations if desired.
      parameters:
      - name: id
        in: path
        description: ID of the policy rule to scan
        required: true
        schema:
          type: string
      - name: simulate
        in: query
        description: Whether or not this scan is a simulation, true means no violation tasks will be created, false or not present will create violations.
        required: false
        schema:
          type: string
      - name: waitForCompletion
        in: query
        description: Whether or not to await the completion of the scan before returning, true will wait, false or not present will return after scan creation.
        required: false
        schema:
          type: string
      responses:
        201:
          description: Policy rule scan started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        404:
          description: Policy does not exist
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/user/{id}/scan:     
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Run a scan for violations on the given single user 
      description: The end point will run a scan on the given user rule, and return potential violations
      parameters:
      - name: id
        in: path
        description: ID of the user to scan
        required: true
        schema:
          type: string
      - name: simulate
        in: query
        description: Whether or not this scan is a simulation, true means no violation tasks will be created, false or not present will create violations.
        required: false
        schema:
          type: string
      requestBody:
        description: If running a preventative scan, additional access may be provided to simulate access not yet granted to user
        content:
          application/json:
            schema:
              type: object
              properties: 
                additionalAccess:
                  type: array
                  description: Additional access to mock on user
                  items:
                    type: object
                    properties:
                      type:
                        type: string
                        description: Type of access (e.g. ResourceGrant)
                      entitlementId:
                        type: string
                        description: ID of entitlement, for those types of access that include entitlements
                      accountId:
                        type: string
                        description: ID of account, for those types of access that include accounts
                policyRuleFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
        required: false
      responses:
        201:
          description: User policy scan started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/policy/scan:          
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Segregation of Duty
      summary: Query policy scans
      description: The endpoint will return policy scans stored within the IGA store, based on a set of query parameters.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyScan'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/policy/scan/search:       
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Search policy scans
      description: Query the policy scan objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"   
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PolicyScan'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}      
  /governance/policy/scan/{id}:        
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Segregation of Duty
      summary: Get policy scan by ID
      description: The endpoint will return the policy scan with the provided ID.
      parameters:
      - name: id
        in: path
        description: ID of the policy scan
        required: true
        schema:
          type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        404:
          description: 'ID not found'
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    delete:
      tags:
      - Segregation of Duty
      summary: Delete an existing policy scan
      description: The end point will allow for deleting an existing policy scan object within IGA.
      parameters:
      - name: id
        in: path
        description: ID of the policy scan to delete
        required: true
        schema:
          type: string
      responses:
        200:
          description: Delete success, returns the removed policy scan object
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyScan'
        404:
          description: 'ID not found'
          content: {}
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/user/violation:          
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Segregation of Duty
      summary: Get violations the logged in user has access too.
      description: Query the logged in user's violation objects.
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation:          
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Segregation of Duty
      summary: Get violations
      description: Query the violation objects
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter"
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    post:
      tags:
      - Segregation of Duty
      summary: Creates a violation
      description: creates a violation with the given body
      parameters:
      - $ref: "#/components/parameters/allPolicyAction"
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/Violation'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/allow:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Bulk API to close entire violations, allowing access to remain indefinitely
      description: Once a phase (or phases) have chosen to allow, this endpoint can be used to close and complete the violations with an outcome of allow
      parameters:
      - name: waitForCompletion
        in: query
        description: Whether or not to await the completion of violations before returning, true will wait, false or not present will return after phase completion.
        required: false
        schema:
          type: string
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkBaseViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to allow violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/cancel-exception:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Bulk API to cancel exception on a group of violations.
      description: As an actor on violations, cancel existing exceptions, reverting the violations back to in-progress.
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkBaseViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to comment violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/comment:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Bulk API to allow actors to add a comment to the violations.
      description: As an actor on violations, add a comment to the violation objects.
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkCommentViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to comment violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/exception:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Bulk API to allow access to remain for a defined period of time.
      description: As an actor on violations, grant an exception to the violating access.
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkExceptionViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to comment violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/reassign:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Bulk API to edit the actors and permissions on the violations.
      description: As a violation actor, edit the list of active actors on the violation tasks.
      requestBody:
        description: Array of violations to act on and additional properties for the action.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkReassignViolationsRequest'
        required: true
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkViolationResponse'
        403:
          description: User is not authorized to comment violations
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {} 
  /governance/violation/search:  
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Search violations
      description: Query the violation objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter" 
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/user/violation/search:       
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Search violations the logged in user is associated with.
      description: Query the logged in user's violation objects using a targeted search filter
      parameters:
        - $ref: "#/components/parameters/_fields"
        - $ref: "#/components/parameters/_pageSize"
        - $ref: "#/components/parameters/_pagedResultsOffset"
        - $ref: "#/components/parameters/_sortKeys"
        - $ref: "#/components/parameters/_sortDir"
        - $ref: "#/components/parameters/_searchAfter"
        - $ref: "#/components/parameters/_queryFilter" 
        - name: actorStatus
          in: query
          description: Actor status to search, comma-separated for multiple, e.g. "active", "inactive", or "active,inactive"
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/TargetFilterNode'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {} 
  /governance/violation/{id}:   
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    get:
      tags:
      - Segregation of Duty
      summary: Get a violation by ID
      description: Query the contents of a single violation object
      parameters:
      - name: id
        in: path
        description: ID of the violation
        required: true
        schema:
          type: string
      - name: resolveSchemas
        in: query
        description: When 'true', enrich the policyRule remediation schemas property with the full schema objects rather than just the IDs
        required: false
        schema:
          type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        404:
          description: Violation does not exist
          content: {}
        400:
          description: Invalid request
          content: {}
        500:
          description: Server error
          content: {}
    put:
      tags:
      - Segregation of Duty
      summary: Updates a given violation
      description: Updates a given violation with the given body
      parameters:
      - name: id
        in: path
        description: ID of the violation
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                targetFilter:
                  $ref: '#/components/schemas/Violation'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Violation'
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
    delete:
      tags:
      - Segregation of Duty
      summary: Deletes a Violation
      description: Deletes a violation from the given ID
      parameters:
      - name: id
        in: path
        description: ID of the violation
        required: true
        schema:
          type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: string
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/allow:    
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Close entire violation, allowing access to remain indefinitely
      description: Once a phase (or phases) have chosen to allow, this endpoint can be used to close and complete the violation with an outcome of allow
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to allow violation
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}             
  /governance/violation/{id}/comment:        
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Comment on violation
      description: As an actor on a violation, add a comment to the violation object.
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              required: [ comment ]
              properties:
                comment:
                  type: string
                  description: Comment to leave on violation
        required: true
      responses:
        201:
          description: Comment added
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to comment on violation
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/remediate:   
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Complete a violation with an outcome of remediate
      description: Once a phase (or phases) have chosen to remediate the violation, this endpoint can be used to complete the violation with an outcome of remediate, and continue the workflow on to either the automated or manual process for fulfilling the remediation.
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      requestBody:
        description: Contents of the action.  Properties will be determined by the requirements of the remediation schema chosen by the id provided in the body.
        content:
          application/json:
            schema:
              type: object
              properties:
                id:
                  type: string
                  description: ID of the remediation schema user has chosen
        required: true
      responses:
        200:
          description: Remediation process begun
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to remediate violation
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}           
  /governance/violation/{id}/remediation/status/{status}:    
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Update the remediationStatus of a violation that is currently being remediated
      description: For violations that have been given an outcome of 'remediate', this endpoint will allow the remediationStatus key to be updated, e.g. from in-progress to complete, and will finalize the violation when appropriate.
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: status
        in: path
        required: true
        description: Status to update remediationStatus to
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        404:
          description: 'Violation ID was not found'
          content:  {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}      
  /governance/violation/{violationId}/phases:  
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
        - Segregation of Duty
      description: Add phase to violation
      parameters:
        - name: violationId
          in: path
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                phase:
                  $ref: '#/components/schemas/TaskPhase'
                actors:
                  type: array
                  items:
                    $ref: '#/components/schemas/ViolationActor'
      responses:
        200:
          description: OK
        404:
          description: 'Violation not found'
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/allow:  
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Make a decision to allow access to remain
      description: As an actor on a violation, allow the user to continue to violate the defined rule in perpetuity
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: phaseName
        in: path
        required: true
        description: Name of the phase
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment justifying allow
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        404:
          description: Violation not found
          content: {}
        403:
          description: User not authorized to take action
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}   
  /governance/violation/{id}/phases/{phaseName}/cancel-exception:    
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Cancel an exception on a violation
      description: As an actor on a violation, cancel an existing exception, reverting the violation back to in-progress.
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: phaseName
        in: path
        required: true
        description: Name of the phase
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment describing the reason for exception being canceled.
      responses:
        200:
          description: Exception canceled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/comment:      
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Comment on violation
      description: As an actor on a violation, add a comment to the violation object.
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: phaseName
        in: path
        required: true
        description: Name of the phase
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              required: [ comment ]
              properties:
                comment:
                  type: string
                  description: Comment to leave on violation
        required: true
      responses:
        200:
          description: Comment added
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/exception:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Allow access to remain for a defined period of time
      description: As an actor on a violation, grant an exception to the violating access.
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: phaseName
        in: path
        required: true
        description: Name of the phase
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              required: [ exceptionExpirationDate ]
              properties:
                exceptionExpirationDate:
                  type: string
                  description: Date that exception will expire
                comment:
                  type: string
                  description: Comment to leave on exception
        required: true
      responses:
        200:
          description: Exception granted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: Violation not found
          content: {}
        401:
          description: User not authorized to make exception on violation
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/reassign:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Edit the actors and permissions on the violation
      description: As a violation actor, edit the list of active actors on a violation task
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: phaseName
        in: path
        required: true
        description: Name of the phase
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              required: [ updatedActors ]
              properties:
                updatedActors:
                  type: array
                  items:
                    $ref: '#/components/schemas/ViolationActor'
        required: true
      responses:
        200:
          description: Actors reassigned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/remediate:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Make a decision to remediate access
      description: As an actor on a violation, choose to remediate the access, kicking off the remediation workflow assigned to the violation.  Request body will depend on remediation schema chosen by user
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: phaseName
        in: path
        required: true
        description: Name of the phase
        schema:
          type: string
      requestBody:
        description: Contents of the action.  Properties will be determined by the requirements of the remediation schema chosen by the id provided in the body.
        content:
          application/json:
            schema:
              type: object
              properties:
                id:
                  type: string
                  description: ID of the remediation schema user has chosen
        required: true
      responses:
        200:
          description: Remediation process begun
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/complete:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Mark a violation provisioning task as complete
      description: As an actor on a manual provisioning task to handle violation remediation, mark the action as completed
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: phaseName
        in: path
        required: true
        description: Name of the phase
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment for the complete action
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/violation/{id}/phases/{phaseName}/cancel:
    parameters:
      - $ref: "#/components/parameters/apiVersionHeader"
    post:
      tags:
      - Segregation of Duty
      summary: Mark a violation provisioning task as canceled (a.k.a not completed)
      description: As an actor on a manual provisioning task to handle violation remediation, mark the action as canceled (not completed)
      parameters:
      - name: id
        in: path
        required: true
        description: ID of the violation
        schema:
          type: string
      - name: phaseName
        in: path
        required: true
        description: Name of the phase
        schema:
          type: string
      requestBody:
        description: Contents of the action
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: Comment reason for cancel
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Violation'
        403:
          description: User is not authorized to take action
          content: {}
        404:
          description: Violation not found
          content: {}
        400:
          description: Invalid request.
          content: {}
        500:
          description: Server error
          content: {}
  /governance/workflow:
    get:
      tags:
      - Workflow
      description: Get a list of workflow definitions that are saved to the backend. Workflow definitions are either in status 'draft' of 'published'. Published workflow definitions are tied to a request type by `id` and `name`. Published workflow definitions are used by corresponding access request. Draft workflow definitions can be worked on by end user and publish to backend. The draft workflow `id` and  `name` corresponds to the published workflow defintion `id` and `name`.
      summary: Get workflow definitions
      parameters:
      - name: _searchAfter
        in: query
        description: Elastic Search After key. Used for pageNumber/
        schema:
          type: string
      - name: _pagedResultsOffset
        in: query
        description: Offset used to determine pageNumber returned.
        schema:
          type: string
      - name: _pageSize
        in: query
        description: Number of documents to return
        schema:
          type: string
      - name: _queryString
        in: query
        description: String to filter the workflows. Matches the workflow displayName, description, and name keys.
        schema:
          type: string
      responses:
        200:
          description: OK
    post:
      tags:
      - Workflow
      description: Create or publish an an workflow definition (workflow). Can be create, publish, execute, validate. Only DB deployed IGA instances support the execute action.
      summary: Create and/or Publish Workflow Definition
      parameters:
         - $ref: "#/components/parameters/workflowActions"
      requestBody:
        description: The data to pass into the workflow
        content:
          '*/*':
            schema:
               $ref: '#/components/schemas/Workflow'
        required: false
      responses:
        201:
          description: Creation success, returns the saved workflow object
          content:
            application/json:
              schema:
                type: object
        400:
          description: Invalid data provided.
          content: {}
        500:
          description: Server error on save.
          content: {}
  /governance/workflow/{id}/{status}:
    get:
      tags:
      - Workflow
      description: Get workflow definition.
      summary: Get Workflow Definition
      parameters:
        - name: id
          in: path
          description: ID of the workflow
          required: true
          schema:
            type: string
        - name: status
          in: path
          description: id of the workflow
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workflow'
        400:
          description: Bad Request
        500:
          description: Internal Service Error
        404:
          description: Workflow with ID was not found.
    delete:
      tags:
      - Workflow
      description: Delete workflow definition.
      summary: Delete workflow definition.  If the status is published, it will try to delete the workflow model and process definition in IDM.
      parameters:
        - name: id
          in: path
          description: ID of the workflow
          required: true
          schema:
            type: string
        - name: status
          in: path
          description: ID of the workflow
          required: true
          schema:
            type: string
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                     anyOf:
                      - $ref: "#/components/schemas/AccessGrant"
                  searchAfterKey:
                    type: array
                    description: As an alternative to page number, searchAfterKey can be used in subsequent requests as an offset identifier from which to continue pagination.
                    items:
                      type: string
                      example: a321329c-a7e6-47ad-8349-99b6e38f9a59
                  totalCount:
                    type: integer
                    description: The total number of results that match the given search.
                  resultCount:
                    type: integer
                    description: The total number of results that were returned in this search.
  /governance/workflow/{id}:
     put:
        tags:
        - Workflow
        description: Update or publish the worfklow definition.
        summary: Update or publish the worfklow definition
        parameters:
          - name: id
            in: path
            description: ID of the workflow to update
            required: true
            schema:
              type: string
        requestBody:
          description: The updated data to save.
          content:
            '*/*':
              schema:
                 $ref: '#/components/schemas/Workflow'
        responses:
          200:
            description: OK
            content:
              application/json:
                schema:
                  $ref: '#/components/schemas/Workflow'
          400:
            description: Bad Request
          500:
            description: Internal Service Error
          404:
            description: Workflow with ID was not found.
components:
  parameters:
    apiVersionHeader:
      name: Accept-API-Version
      in: header
      description: API version to use for the request. If no value is provided, latest version of API is used to process the request.
      required: false
      schema:
        type: string
        example: resource=1.0
    _pageSize:
      name: _pageSize
      in: query
      description: Number of response result objects to return.
      schema:
        type: integer
        example: 10
    _pagedResultsOffset:
      name: _pagedResultsOffset
      in: query
      description: Offset number of the record from which to start the paginated results.
      schema:
        type: integer
        example: 10
    _fields:
      name: _fields
      in: query
      description: The list of fields to return for each entry in the response result. Comma-separated for multiple values.
      schema:
        type: string
        example: user.userName,application.name,id
    _sortKeys:
      name: _sortKeys
      in: query
      description: The property on which to sort the results.
      schema:
        type: string
        example: application.name
    _sortDir:
      name: _sortDir
      in: query
      description: The direction of sort, asc or desc.
      schema:
        type: string
        example: asc
        enum:
         - asc
         - desc
    _sortType:
      name: _sortType
      in: query
      description: The type of sort value. Special types of fields need to use this parameter in order to be sorted properly.  Currently the supported special types are 'date' and 'integer'.  This can be omitted for other fields.
      schema:
        type: string
        example: date
        enum:
         - date
         - integer
    _searchAfter:
      name: _searchAfter
      in: query
      description: The sort property values of the last entry to continue searching from. Comma-separated for multiple values.
      schema:
        type: string
        example: a321329c-a7e6-47ad-8349-99b6e38f9a59
    allRequestsAction:
      name: _action
      in: query
      required: true
      description: Action to be performed for requests endpoint.
      schema:
        type: string
        enum:
          - create
          - validate
    allPolicyAction:
      name: _action
      in: query
      required: true
      description: Action to be performed for requests endpoint.
      schema:
        type: string
        enum:
          - create
          - duplicate    
    workflowActions:
      name: _action
      in: query
      required: true
      description: Action to be performed for workflow endpoint.
      schema:
        type: string
        enum:
          - create
          - validate
          - publish
          - execute
    singleRequestAction:
      name: _action
      in: query
      required: true
      description: Action to be performed on a single request.
      schema:
        type: string
        enum:
          - cancel
          - approve
          - reject
          - comment
          - reassign
          - update
          - modify
    userIdForRequests:
      name: userId
      in: path
      required: true
      description: Unique identifier of the user.
      schema:
        type: string
        example: 3f9aeffb-dec7-484d-9031-a9e28646d284
    userIdForTasks:
      name: userId
      in: path
      required: true
      description: Unique identifier of the user.
      schema:
        type: string
        example: 3f9aeffb-dec7-484d-9031-a9e28646d284
    userId:
      name: userId
      in: path
      required: true
      description: Unique identifier of the user.
      schema:
        type: string
        example: 3f9aeffb-dec7-484d-9031-a9e28646d284
    userRequestsAction:
      name: _action
      in: query
      required: true
      description: Action to be performed on user requests endpoint.
      schema:
        type: string
        enum:
          - search
    userApprovalsAction:
      name: _action
      in: query
      required: true
      description: Action to be performed on user approvals endpoint.
      schema:
        type: string
        enum:
          - search
    userTasksAction:
      name: _action
      in: query
      required: true
      description: Action to be performed on user tasks endpoint.
      schema:
        type: string
        enum:
          - search
    userTaskType:
      name: type
      in: query
      required: false
      description: The type of task to filter by
      schema:
        type: string
        enum:
          - request
          - violation
          - fulfillment
    accessProvisioningAction:
      name: _action
      in: query
      required: true
      description: Action to be performed on access provisioning endpoint.
      schema:
        type: string
        enum:
          - add
          - remove
    allAccountAction:
      name: _action
      in: query
      required: true
      description: Action to be performed for account endpoint.
      schema:
        type: string
        enum:
          - search
    allAccountGlossaryAction:
      name: _action
      in: query
      required: true
      description: Action to be performed for account endpoint.
      schema:
        type: string
        enum:
          - create
    allEntitlementGrantGlossaryAction:
      name: _action
      in: query
      required: true
      description: Action to be performed for account endpoint.
      schema:
        type: string
        enum:
          - create
    allEventAction:
      name: _action
      in: query
      required: true
      description: Action to be performed for event endpoint.
      schema:
        type: string
        enum:
          - create
    allScopeAction:
      name: _action
      in: query
      required: true
      description: Action to be performed for scope endpoint.
      schema:
        type: string
        enum:
          - create
    entitlementId:
      name: entitlementId
      in: query
      required: true
      description: ID of entitlement
      schema:
        type: string
        example: system/TargetADApp/__GROUP__/0fcfd73c-6c0a-4ad3-a580-95795af493c5
    accountId:
      name: accountId
      in: query
      required: true
      description: ID of account
      schema:
        type: string
        example: system/TargetADApp/User/8df77c8b-dac0-4cc5-9f38-b4a467983609
    ignoreRequestable:
      name: ignoreRequestable
      in: query
      required: false
      description:  For admin use, will allow admin to view catalog items not marked as requestable when set to true
      schema:
        type: string
        example: false
    catalogUserId:
      name: userId
      in: query
      required: false
      description:  For admin use, when provided will return the scoped catalog access that matches the given user id.
      schema:
        type: string
        example: 3f9aeffb-dec7-484d-9031-a9e28646d284
    _queryFilter:
      name: _queryFilter
      in: query
      required: false
      description: The search query filter
      schema:
        type: string
  schemas:
    PatchPayload:
      type: array
      items: 
        type: object
        properties:
          operation:
            type: string
            description: The operation apply to the field
            enum: [add, replace, copy, move, increment, remove, transform]
          field:
            description: The field that will be updated
            type: string
            example: "/type"
          value: 
            description: The value of the field
    RequestForm:
      type: object
      description: This is the schema definition of request form
      required:
        - type
        - name
        - form
      allOf:
        - type: object
          properties:
            id: 
              type: string
              description: The ID of the request form
            name:
              type: string
              description: The name of the request form
            type:
              type: string
              description: The type of the request
              example: request
            categories:
              type: object
              description: The category information of the form.  Categories are name and value pair.
              example: {"applicationType": "active.directory", "objectType": "__ACCOUNT__", "operation": "create"}
            form:
              type: object
              description: the UI form definitoin.  Server will store it as its, and won't interpret it in any way.
        - $ref: '#/components/schemas/MetadataObject'
    RequestFormAssignment:
      type: object
      description: This is the schema defintion of request form assignment
      required:
        - objectId
        - formId
      properties:
        objectId:
          type: string
          description: This must be a unique identifier of the object that you want to assign a request form to.  Keep in mind that request form can be used in different use cases.  Such as create account for an application, sumbitting data for request, etc.  Be sure to have a naming convention that can be use to uniquely identify each user case.  One approach is construct this using a URI like format; For example application/900cb1ac-7d6d-4d26-9d62-13e8858a14d5/objectType/__ACCOUNT__/operation/create, or a simplier version application/900cb1ac-7d6d-4d26-9d62-13e8858a14d5/__ACCOUNT__/create
        formId:
          type: string
          description: The ID of request form
    AccessRequest:
      type: object
      description: This information appears under the request key on any request object.  It contains all of the relevant information submitted by an end user for the request. The fields startDate, endDate, justification, externalRequestId, isDraft and requestIdPrefix under the common key will appear for all requests.  Depending on the request type, there will also be additional request type specific details that appear within this object.
      properties:
        common:
          type: object
          properties:
            startDate:
              type: string
              description: The date that the granted access will take effect.  The value should be provided in ISO8601 format.
              example: 2023-09-11T12:00:00+00:00
            endDate:
              type: string
              description: The date that the granted access will end for the user.  The value should be provided in ISO8601 format.
              example: 2023-12-11T12:00:00+00:00
            justification:
              type: string
              description: The reason for which this request is being submitted.
              example: I need this access to start working on a new project.
            externalRequestId:
              type: string
              description: If using an external service (e.g. SNOW) to manage any portion of the access request flow, you can include an ID reference to that external process using this field.
              example: c926c10f-300a-4222-876f-348e0ca07d63
            isDraft:
              type: boolean
              description: Indicates if the request is currently saved in draft state.  If true, the request process has not begun, and will not until the flag
              example: false
            requestIdPrefix:
              type: string
              description: This field can be used to assign an additional prefix to the generated UUID for the request(s) that are created from this call. For example, a requestIdPrefix of REQ would result in a UUID like REQ-f8c8f9ae-12b3-4316-b011-c117a9c3f1a2.
              example: REQ
    AccessRequestForUsers:
      type: object
      description: This is the payload submitted to either create or validate a request(s) for access.  It includes the list of user IDs, the list of catalog items being requested, and some supporting information that applies to the request like priority, justification, and so on.  Note that a single request will be generated for every combination of user ID and catalog item that is contained in this object.
      properties:
        users:
          type: array 
          items:
            type: string
            example: 52cf01b4-288e-4c21-aed6-f992be073988
          description: List of unique user IDs for whom the access is being requested.
        catalogs:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
                description: The type of access being requested (e.g., application, role, entitlement)
                enum:
                  - application
                  - role
                  - entitlement
              id:
                type: string
                description: Unique ID of the catalog item being requested.
                example: ea412dc4804ae80e625fdd8f7b7521d9ae3f7cae30f2401cf8f3be43d985176843404f1022c44537edeedc0bf11b5e5a028082cc05a7d90843b882c7c4b5d988
              data:
                type: object
                description: An object meant to hold generic request data.
                example: {}
          description: List of catalog items being requested for the users.
        startDate:
          type: string
          description: The date that the granted access will take effect. The value should be provided in ISO8601 format.
          example: 2023-09-11T12:00:00+00:00
        endDate:
          type: string
          description: The date that the granted access will end for the user. The value should be provided in ISO8601 format.
          example: 2023-12-11T12:00:00+00:00
        expiryDate:
          type: integer
          description: The expiry date of the access request, by which if the request is not completed it will be cancelled automatically by the system.  The value should be provided in ISO8601 format.
          example: 2023-09-05T12:00:00+00:00
        priority:
          type: string
          description: The priority of the request, either low, medium, or high.
          default: low
          enum:
            - low
            - medium
            - high
        justification:
          type: string
          description: The reason for which this request is being submitted.
          example: I need this access to start working on a new project.
        accessModifier:
          type: string
          description: The access modifier of this request, i.e., is this an add request or a remove request.
          enum:
            - add
            - remove
        externalRequestId:
          type: string
          description: If using an external service (e.g., SNOW) to manage any portion of the access request flow, you can include an ID reference to that external process using this field.
          example: c926c10f-300a-4222-876f-348e0ca07d63
        requestIdPrefix:
          type: string
          description: This field can be used to assign an additional prefix to the generated UUID for the request(s) that are created from this call. For example, a requestIdPrefix of REQ would result in a UUID like REQ-f8c8f9ae-12b3-4316-b011-c117a9c3f1a2.
          example: REQ
    AccessRequestValidationError:
      type: object
      description: This is the object returned in the errors key from the Access Request create or validate action when a validation error occurs with the submitted request.
      properties:
        error:
          type: string
          description: Unique identifier of error.
          enum:
          - DUPLICATE
          - EXISTING_ACCESS
          - INVALID_CATALOG_ID
          - INVALID_USER_ID
        message:
          type: string
          description: Explanation of why the validation error occurred.
        userId:
          type: string
          description: ID of user causing validation error.
        catalogId:
          type: string
          description: ID of catalog item causing validation error.
        requestId:
          type: string
          description: If error is a duplicate request error, this is the ID of the duplicate request.
      example: {
        "error": "DUPLICATE",
        "message": "Duplicate request already exists.",
        "user": "e7c38019-844f-4b70-93d1-9bdbfa00f1da",
        "requestId": "3cd52fdd-9725-411f-bcae-0f5f3254e24d",
        "catalogId": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1"
      }
    AccessRequestDetail:
      type: object
      description: This is the full request object.  It will include information about the submitted request, requester, user, and any other data relevant to the request such as application, entitlement, and so on.  Some of that additional information that does appear may vary based on the type of request.
      allOf:
        - type: object
          properties:
            id:
              type: string
              description: The unique identifier of the request.
            requester:
              $ref: "#/components/schemas/User"
              description: The user who submitted the request for access.
            requestType:
              type: string
              description: The identifier of the request type.
              enum:
                - applicationGrant
                - applicationRemove
                - entitlementGrant
                - entitlementRemove
                - roleGrant
                - roleRemove
            request:
              $ref: "#/components/schemas/AccessRequest"
            application:
              $ref: "#/components/schemas/Application"
              description: If applicable, the application for which this request's access (account/entitlement) would apply to.
            applicationOwner:
              $ref: "#/components/schemas/ApplicationOwner"
              description: If applicable, the user(s) who are listed as the owner of the application for which this request's access (account/entitlement) would apply to.
            entitlementOwner:
              type: array
              description: If applicable, the user who is listed as the owner of the entitlement for which this request is for.
              items:
                $ref: "#/components/schemas/User"
            roleOwner:
              type: array
              description: If applicable, the user who is listed as the owner of the role for which this request is for.
              items:
                $ref: "#/components/schemas/User"
            user:
              description: The user for whom this request has been submitted for.
              $ref: "#/components/schemas/User"
            decision:
              type: object
              description: The decision key contains all of the information related to the request lifecycle, such as the status, the task information, comments, and more.
              properties:
                status:
                  type: string
                  enum:
                    - in-progress
                    - provisioning
                    - cancelled
                    - complete
                decision:
                  type: string
                  enum:
                    - approved
                    - rejected
                    - null
                  description: The final decision made on the request.  Note this differs from the decision value on a single approval task and represents the overall request decision, as determined by workflow.  For example, a request flow could create three approval tasks over its lifecycle and if 2 out of 3 approve the access, it may determine the final decision is approve.  Or it could decide if any of the three are rejected then the final decision is rejected.
                outcome:
                  type: string
                  enum:
                    - provisioned
                    - not provisioned
                    - denied
                    - cancelled
                    - fulfilled
                  description: The final result of the action that the request was for.  For example, if the request is to add an entitlement to a user and the entitlement is provisioned as expected, the outcome would be 'provisioned'.  If the provisioning was intended but was not completed (e.g. access already granted, provisioning failure), the outcome would be 'not provisioned'. 'denied' is a request that did not get the required approval(s). 'cancelled' is a request that was cancelled before completion.
                startDate:
                  type: string
                  description: The date that the request was created.  The value will be in ISO8601 format.
                  example: 2023-09-10T12:00:00+00:00
                completionDate:
                  type: string
                  description: If request is complete, the date that the request was completed.  The value will be in ISO8601 format.
                  example: 2023-09-10T12:00:00+00:00
                comments:
                  type: array
                  items:
                    $ref: "#/components/schemas/Comment"
                actors:
                  type: object
                  description: The actors object contains all of the users/roles who are assigned to the various approval tasks that belong to this request.  It contains two keys, active and inactive, to denote whether or not they belong to a currently active task or not.
                  properties:
                    active:
                      type: array
                      description: A list of all the users/roles currently assigned to an active task.
                      items:
                        $ref: "#/components/schemas/RequestActorWithPhase"
                    inactive:
                      type: array
                      description: A list of all the users/roles that were assigned to an inactive task.
                      items:
                        $ref: "#/components/schemas/RequestActorWithPhase"
                phases:
                  type: array
                  items:
                    $ref: "#/components/schemas/TaskPhase"
        - $ref: '#/components/schemas/MetadataObject'
    Application:
      type: object
      description: An application object, as stored in IGA
      example: {
        "authoritative": false,
        "connectorId": "AzureAD",
        "description": "AzureAD application",
        "fr": {
            "realm": "alpha"
        },
        "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
        "mappingNames": [
            "systemAzureadUser_managedAlpha_user",
            "systemAzureadDirectoryrole_managedAlpha_assignment",
            "systemAzuread__group___managedAlpha_assignment",
            "managedAlpha_user_systemAzureadUser"
        ],
        "metadata": {
            "entityType": "/openidm/managed/application",
            "created": "2023-08-31T21:23:35.809Z"
        },
        "name": "AzureAD",
        "templateName": "azure.ad",
        "templateVersion": "2.0"
      }
    ApplicationOwner:
      type: array
      description: A list of user objects whom are assigned as the owners of an application
      items:
        $ref: "#/components/schemas/User"
    TaskPhase:
      type: object
      description: A "phase" is an approval task that exists on a request. It can be assigned to one or more users/roles and requires a single action of either approve or reject in order to be completed and move the request workflow flow forward.
      properties:
        phase:
          type: object
          required:
            - name
            - workflowTaskId
          properties:
            name:
              type: string
              description: The identifier of the task in the request, unique within the individual request.
              example: ManagerApproval
            type:
              type: string
              description: The type of task.
              enum:
                - request
            status:
              type: string
              description: The progress status of the approval task.
              enum:
                - in-progress
                - cancelled
                - complete
            decision:
              type: string
              description: The decision that was taken on the approval task.
              enum:
                - approve
                - reject
                - null
            startDate:
              type: string
              description: The date that the approval task was created.  The value will be in ISO8601 format.
              example: 2023-09-10T12:00:00+00:00
            events:
              $ref: "#/components/schemas/PhaseEvents"      
            justification:
              type: string
              description: If provided, the reason for the approval/rejection 
            workflowTaskId:
              type: string
              description: The identifier of the workflow workflow task that created this approval.
              example: 1025
            completedBy:
              description: If task is complete, the user who took the action on the approval task.
              $ref: "#/components/schemas/User"
            completionDate:
              type: string
              description: If task is complete, the date that the approval task was completed. The value will be in ISO8601 format.
              example: 2023-09-10T12:00:00+00:00
    AccessRequestApprovalDetail:
      allOf:
        - $ref: '#/components/schemas/AccessRequestDetail'
        - type: object
          properties: 
            phases:
              type: array
              items:
                $ref: '#/components/schemas/ApprovalPhasesDetail'
    ApprovalPhasesDetail:
      type: object
      description: List of phases that the authenticated user has permissions for
      properties:
        name:
          type: string
          description: Name of phase
        permissions:
          $ref: '#/components/schemas/RequestPermissions'
    Catalog:
      type: object
      description: A single entry within the IGA Access Catalog. Each entry represents a single type of requestable access that can be added to a request.  The current supported types of access that are requestable are application, entitlement, and role.
      example: {
        "id" : "system_TargetADApp2_directoryRole_08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
        "item" : {
          "type" : "entitlementGrant"
        },
        "descriptor" : {
          "idx" : {
            "/entitlement" : {
              "displayName" : "Directory Readers"
            }
          }
        },
        "glossary" : {
          "idx" : {
            "/entitlement" : {
              "requestable" : true
            }
          }
        },
        "entitlement" : {
          "_id" : "08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
          "description" : "Can read basic directory information. Commonly used to grant directory read access to applications and guests.",
          "displayName" : "Directory Readers"
        },
        "assignment" : {
          "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-72216",
          "attributes" : [
            {
              "name" : "__roles__",
              "value" : [
                "08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4"
              ]
            }
          ],
          "description" : "Can read basic directory information. Commonly used to grant directory read access to applications and guests.",
          "fr" : {
            "realm" : "alpha"
          },
          "id" : "system_TargetADApp2_directoryRole_08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
          "mapping" : "managedAlpha_user_systemTargetadapp2User",
          "metadata" : {
            "entityType" : "/openidm/managed/assignment",
            "created" : "2023-06-09T22:09:42.877Z"
          },
          "name" : "Directory Readers",
          "type" : "__ENTITLEMENT__"
        },
        "application" : {
          "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-67718",
          "authoritative" : false,
          "connectorId" : "TargetADApp2",
          "description" : "Target AD App2",
          "fr" : {
            "realm" : "alpha"
          },
          "icon" : "https://openam-glossary-fix-0608.forgeblocks.com/platform/img/microsoft.8a785075.svg",
          "id" : "a4e54fcb-9088-4d42-bb4a-138d69b2486e",
          "mappingNames" : [
            "systemTargetadapp2User_managedAlpha_user",
            "systemTargetadapp2Directoryrole_managedAlpha_assignment",
            "systemTargetadapp2__group___managedAlpha_assignment",
            "managedAlpha_user_systemTargetadapp2User"
          ],
          "metadata" : {
            "entityType" : "/openidm/managed/application",
            "created" : "2023-06-09T20:43:57.74Z"
          },
          "name" : "TargetADApp2",
          "ssoIdentities" : {
            "oidcId" : "TargetADApp2"
          },
          "templateName" : "azure.ad",
          "templateVersion" : "2.0"
        },
        "applicationOwner" : [
          {
            "_rev" : "23b2b11e-3ee6-499d-9e66-88ea2a867f98-1944",
            "accountStatus" : "active",
            "cn" : "iga admin",
            "fr" : {
              "realm" : "alpha"
            },
            "givenName" : "iga",
            "id" : "b409de90-dc24-42ee-b315-7e133c7cfaca",
            "mail" : "iga-admin@fr.net",
            "metadata" : {
              "entityType" : "/openidm/managed/user",
              "created" : "2023-06-08T23:02:15.385Z"
            },
            "sn" : "admin",
            "userName" : "iga-admin"
          }
        ],
        "metadata": {
          "firstCreated": "2024-01-11T12:00:00+00:00",
          "created": "2024-04-24T12:00:00+00:00"
        }
      }
    User:
      type: object
      description: The properties of a user object.
      properties:
        id:
          type: string
          description: ID of user in full ID format, e.g., managed/user/003 or managed/user/123.
          example: a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761
        userName:
          type: string
          description: The userName field for the user.
          example: asmith
        mail:
          type: string
          description: The mail field for the user.
          example: asmith01@forgerock.com
        givenName:
          type: string
          description: The givenName field for the user.
          example: Aaron
        sn:
          type: string
          description: The sn field for the user.
          example: Smith
    Role:
      type: object
      description: The properties of a role object.
      properties:
        id:
          type: string
          description: ID of role in full ID format, e.g., managed/role/003 or managed/role/123.
        name:
          type: string
          description: The name of the role.
    RequestActor:
      allOf:
        - anyOf:
          - $ref: '#/components/schemas/User'
          - $ref: '#/components/schemas/Role'
        - type: object
          properties:
            permissions:
              $ref: '#/components/schemas/RequestPermissions'
    RequestActorWithPhase:
      allOf:
        - anyOf:
          - $ref: '#/components/schemas/User'
          - $ref: '#/components/schemas/Role'
        - type: object
          properties:
            permissions:
              $ref: '#/components/schemas/RequestPermissions'
            phase:
              type: string
              description: Name of approval task this actor is assigned to.
              example: ManagerApproval
    ProvisioningActor:
      allOf:
        - anyOf:
          - $ref: '#/components/schemas/User'
          - $ref: '#/components/schemas/Role'
        - type: object
          properties:
            permissions:
              $ref: '#/components/schemas/ProvisioningPermissions'
    RequestPermissions:
      type: object
      description: The list of permissions that a user or role that is assigned to a request approval task is granted.  When true, the user/role is allowed to execute that action.  If false, they are not.
      properties:
        approve:
          type: boolean
          description: User is allowed to take the approve action on the request approval task.
        comment:
          type: boolean
          description: User is allowed to take the comment action on the request approval task.
        modify:
          type: boolean
          description: User is allowed to take the modify action on the request approval task.
        reassign:
          type: boolean
          description: User is allowed to take the reassign action on the request approval task.
        reject:
          type: boolean
          description: User is allowed to take the reject action on the request approval task.
    ProvisioningPermissions:
      type: object
      description: The list of permissions that a user or role that is assigned to a provisioning task is granted.  When true, the user/role is allowed to execute that action.  If false, they are not.
      properties:
        cancel:
          type: boolean
          description: User is allowed to take the cancel action on the provisioning task.
        comment:
          type: boolean
          description: User is allowed to take the comment action on the provisioning task.
        complete:
          type: boolean
          description: User is allowed to take the complete action on the provisioning task.
        reassign:
          type: boolean
          description: User is allowed to take the reassign action on the provisioning task.
    Comment:
      description: A comment made by a user on an IGA object.
      type: object
      properties:
        user:
          description: The information on the user who added the comment to the request.
          $ref: "#/components/schemas/User"
        comment:
          type: string
          description: The contents of the comment.
          example: I need to find out more information before approving. Will check back later.
        action:
          type: string
          description: The context of the comment. For example, comment will be the action for a normal comment, while reassign is the action when an approval's assignee is changed and a comment is added.
          example: comment
        timeStamp:
          type: string
          description: The date/time at which the comment was added. The value will be in ISO8601 format.
          example: 2023-09-11T12:00:00+00:00
        phase:
          type: string
          description: The name of the approval task through which this comment was made.
          example: ManagerApproval
    TargetFilterNode:
      type: object
      description: A targetFilter object, used to build a custom search filter to retrieve desired results.
      properties:
        operator:
          type: string
          enum:
            - EQUALS
            - CONTAINS
            - IN
            - STARTS_WITH
            - ENDS_WITH
            - GT
            - GTE
            - LT
            - LTE
            - RANGE
            - EXISTS
            - AND
            - OR
            - NOT
        operand:
          $ref: '#/components/schemas/TargetFilterLeafNode'
      example: {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      }
    TargetFilterLeafNode:
      type: object
      description: The lowest level object in a targetFilter, it targets a specific target name and value that is being used for the search criteria.
      properties:
        targetName:
          type: string
          description: The field being targeted by the search.
          example: object.name
        targetValue:
          type: string
          description: The value being targeted by the search.
          example: Active Directory
    PhaseEvents:
      type: object
      description: The events object allows for the configuration of different events that occur over the lifecycle of a given approval task.  These events currently include assignment, reassign, expiration, escalation, and reminder.  Each individual approval task can define their own unique configuration for any or all of these events, independent from other approval tasks within or outside of the request to which it belongs.
      properties:
        assignment:
          type: object
          description: The assignment event allows for configuring what notification will be sent to the assigned users or roles when the task is first created.
          properties:
            notification:
              type: string
              description: ID of the notification that will be sent for the assignment event.
              example: requestAssigned        
        reassign:
          type: object
          description: The reassign event allows for configuring what notification will be sent any time a user or role is added to this approval task after it is created.
          properties:
            notification:
              type: string
              description: ID of the notification that will be sent for the reassignment event.
              example: requestReassigned
        expiration:
          type: object
          description: The expiration event allows for expiration behavior to be defined when the provided expiration date has been reached.  A task can have no expiration behavior, can send a notification, or can take one of two pre-defined actions to advance the approval process.
          properties:
            date:
              type: string
              description: The date the expiration event will occur.
              example: 2023-09-04T12:00:00+00:00
            notification:
              type: string
              description: ID of the notification that will be sent for the expiration event.
              example: requestExpired
            action:
              type: string
              description: The options for expiration behavior. If not present, no action will be taken on expiration.  If reject, the approval task will be rejected by the system and the workflow flow will continue.  If reassign, the task will be reassigned to the provided users/roles and will remain active pending their action.
              enum:
                - reassign
                - reject
            actors:
              type: array
              description: When action is reassign, this is the list of user or roles that will replace the current list of approvers assigned to the approval task.
              items:
                $ref: '#/components/schemas/RequestActor'
        escalation:
          type: object
          description: The escalation event allows for periodic notifications to be sent to a specific list of users/roles that are defined on this event and assigned to receive these notifications.
          properties:
            date:
              type: string
              description: The date the escalation notifications will be sent. If a frequency value is also set on this event, the date will be updated to the next calculated date after each notification date is reached and notifications are sent.
              example: 2023-09-04T12:00:00+00:00
            notification:
              type: string
              description: ID of the notification that will be sent for the escalation event.
              example: requestEscalated
            actors:
              type: array
              description: The list of user or role objects that will be sent the escalation notification when the date is reached.
              items:
                type: object
                example:
                  {
                    id: 875bbc8f-e868-451f-a690-453473205ca1
                  }
            frequency:
              type: integer
              description: The amount of time, in days, between each escalation notification being sent.
              example: 3
        reminder:
          type: object
          description: The reminder event allows for periodic notifications to be sent to the list of users/roles that are currently assigned to this approval task.
          properties:
            date:
              type: string
              description: The date the reminder notifications will be sent. If a frequency value is also set on this event, the date will be updated to the next calculated date after each notification date is reached and notifications are sent.
              example: 2023-09-04T12:00:00+00:00
            notification:
              type: string
              description: ID of the notification that will be sent for the reminder event.
              example: requestReminder
            frequency:
              type: integer
              description: The amount of time, in days, between each reminder notification being sent.
              example: 3
    ProvisionGrantTypes:
      type: string
      description: The mechanism for a given provisioning action, request if done so via a request, or admin if directly assigned by an administrator.
      enum:
        - request
        - admin
    ProvisionApplicationRequest:
      type: object
      description: Schema for application provisioning request.
      required: [ 'applicationId' ]
      properties:
        applicationId:
          type: string
          example: 0c067d47-f07c-46d6-9162-14476d18d87a
        startDate:
          type: string
          description: The date that the granted access will take effect. The value should be provided in ISO8601 format.
          example: 2023-09-11T12:00:00+00:00
        endDate:
          type: string
          description: The date that the granted access will end for the user. The value should be provided in ISO8601 format.
          example: 2023-12-11T12:00:00+00:00
        grantType:
          $ref: "#/components/schemas/ProvisionGrantTypes"
    ProvisionRoleRequest:
      type: object
      description: Schema for role provisioning request.
      required: [ 'roleId' ]
      properties:
        roleId:
          type: string
          example: 0c067d47-f07c-46d6-9162-14476d18d87a
        startDate:
          type: string
          description: The date that the granted access will take effect. The value should be provided in ISO8601 format.
          example: 2023-09-11T12:00:00+00:00
        endDate:
          type: string
          description: The date that the granted access will end for the user. The value should be provided in ISO8601 format.
          example: 2023-12-11T12:00:00+00:00
        grantType:
          $ref: "#/components/schemas/ProvisionGrantTypes"
    ProvisionEntitlementRequest:
      type: object
      description: The payload this is required in order to submit a request to provision an entitlement to a user.
      required: [ 'entitlementId' ]
      properties:
        entitlementId:
          type: string
          example: 0c067d47-f07c-46d6-9162-14476d18d87a
        startDate:
          type: string
          description: The date that the granted access will take effect. The value should be provided in ISO8601 format.
          example: 2023-09-11T12:00:00+00:00
        endDate:
          type: string
          description: The date that the granted access will end for the user. The value should be provided in ISO8601 format.
          example: 2023-12-11T12:00:00+00:00
        grantType:
          $ref: "#/components/schemas/ProvisionGrantTypes"
    IGAConfig:
      type: object
      description: IGA configuration options for all functionality. Each subsection of configuration functionality will be a top level key on this configuration object.
      required: [ 'iga_access_request' ]
      allOf:
        - type: object
          properties:
            iga_access_request:
              $ref: '#/components/schemas/IGAAccessRequestConfig'
            iga_global:
              $ref: '#/components/schemas/IGAGlobalConfig'
            iga_autoid_integration: 
              $ref: '#/components/schemas/IGAAutoIdConfig'
    IGAAccessRequestConfig:
      type: object
      description: IGA configuration options specifically related to access request use cases.
      allOf:
        - type: object
          properties:
            requireRequestJustification:
              type: boolean
              description: Whether requests require justification to be submitted.
            requireRejectJustification:
              type: boolean
              description: Whether request rejections require justification to be submitted.
            requireApproveJustification:
              type: boolean
              description: Whether request approvals require justification to be submitted.
            preventRequestWithViolation: 
              type: boolean
              description: Prevents whether or not a request can be generated if it causes violations.
            requireRequestJustificationWithViolation:
              type: boolean
              description: Whether requests require justification to be submitted on violations generated.
            defaultApprover:
              type: string
              description: The default role that can be used to handle approvals when an approver cannot be calculated.
              example: 'managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4'
            allowSelfApproval:
              type: boolean
              description: Whether a user is allowed to approve/reject an approval task on a request for their own access.
    IGAGlobalConfig:
      type: object
      description: IGA configuration options that are applied across IGA functionality.
      allOf:
        - type: object
          properties:
            enableScoping:
              type: boolean
              description: Whether or not scoping rules are evaluated during IGA operations (e.g., catalog search).
              example: false
    IGAAutoIdConfig:
      type: object
      description: IGA configuration options specifically related to auto id use cases.
      allOf:
        - type: object
          properties:
            enableAutoId:
              type: boolean
              description: Whether auto id is enabled or not.
            highScorePercentThreshold:
              type: number
              description: The high score percentage threshold.
            mediumScorePercentThreshold:
              type: number
              description: The medium score percentage threshold.
            lowScorePercentThreshold: 
              type: number
              description: The low score percentage threshold.
            training_features_filter:
              type: array
              items:
                type: string
              description: Who would be filtering training features for a given user
              example: ['user.managerId']
    CatalogSchemaProperty:
      type: object
      description: A catalog schema entry, which are the searchable fields on which the catalog entries can be filtered by.
      properties:
        key:
          type: string
          description: The path to the property within an individual IGA catalog entry.
          example: application.description
        name:
          type: string
          description: The identifier of the schema property, the last item in the key path.
          example: description
        displayName:
          type: string
          description: The readable display friendly name of the schema property.
          example: Description
        description:
          type: string
          description: An explanation of what this schema property is used for.
          example: This property is used to provide information about a given application.
        type:
          type: string
          description: The type of data this property holds.
          enum:
            - string
            - integer
            - boolean
            - managedObject
        managedObjectType:
          type: string
          description: Applicable only when type is set to 'managedObject', contains the type of object this property refers to.
          example: /openidm/managed/role
        isMultiValue:
          type: boolean
          description: Does this property support multiple values.
        isInternal:
          type: boolean
          description: Does this property represents an out-of-the-box glossary schema attribute.
        enumeratedValues:
          type: array
          description: List of objects representing the possible values allowed for this attribute, each containing a label field "text" and a value field "value."
          items:
            type: object
            properties:
              text:
                type: string
                description: Display friendly label of option.
              value:
                type: string
                description: Actual value of option.
    AccountDetail:
      type: object
      description: This is the full account API response object. It will include information about the account itself, as well as any supporting information.  This information includes, but is not limited to, user, application, application owner, glossary, and normalized information (descriptor).
      allOf:
        - type: object
          properties:
            id:
              type: string
              description: The unique identifier of the account.
              example: system/TargetADApp/User/8df77c8b-dac0-4cc5-9f38-b4a467983609
            keys:
              type: object
              example: {
                "type": "accountGrant",
                "userId": "041ae68e-c54d-43ae-957d-5bda01d6f259",
                "applicationId": "a87e3d1f-1f9e-4597-bb0a-2ed56d2484a3",
                "accountId": "system/TargetADApp/User/6841028f-2cf7-4439-afa2-51cc3fcb0363"
              }
            account:
              description: The account details. Note that the data in here will be completely dependent on the individual application to which the account belongs.
              example: {
              "state": "PA",
              "status": "3",
              "isManager": "no",
              "depName": "Human Resources",
              "__UID__": "2014",
              "phone": "555-1212",
              "city": "Allentown",
              "jobCode": "2002",
              "address": "1234 Spruce St",
              "__NAME__": "2014",
              "uid": "2014",
              "lastName": "Hart",
              "firstName": "Jeremy",
              "country": "US",
              "depId": "200",
              "email": "jhart@forgerock.com",
              "empType": "1",
              "postalCode": "12345",
              "_id": "2014"
              }
            user:
              description: The user for whom this account belongs to.
              $ref: "#/components/schemas/User"
            application:
              $ref: "#/components/schemas/Application"
              description: The application to which this account belongs.
            applicationOwner:
              $ref: "#/components/schemas/ApplicationOwner"
              description: The user(s) who are listed as the owner of the application for which this account belongs to.
            descriptor:
              description: The normalized, searchable, and sortable information belonging to objects within this response.
              type: object
              properties:
                idx:
                  type: object
                  properties:
                    /account:
                      type: object
                      description: Account related searchable and sortable information
                      properties:
                        displayName:
                          type: string
                          description: The display friendly name for the account
                          example: Example Account
            glossary:
              description: The searchable and sortable information belonging to glossary entries of the objects within this response.
              type: object
              properties:
                idx:
                  type: object
                  properties:
                    /account:
                      type: object
                      description: Account related searchable and sortable information
                      example: {
                        "accountType": "normal",
                        "accountStatus": "active"
                      }
                    /application:
                      type: object
                      description: Account related searchable and sortable information
                      example: {
                        "requestable": true,
                        "classification": "internal"
                      }
            item:
              type: object
              properties:
                decision:
                  type: object
                  properties:
                    campaignId:
                      type: string
                      description: ID of the campaign during which this account was last certified.
                    completedBy:
                      $ref: "#/components/schemas/User"
                      description: Information on the user that signed off on this item's last certification.
                    completionDate:
                      type: string
                      description: Date time that the sign off action was taken on this item's certification.
                    decision:
                      type: string
                      description: Decision that was taken on this account grant.
                      enum:
                      - certify
                      - revoke
                      - exception
                    decisionBy:
                      $ref: "#/components/schemas/User"
                      description: Information on the user that took the certification decision action.
                    decisionDate:
                      type: string
                      description: Date time that the decision action was taken on this item's certification.
        - $ref: '#/components/schemas/MetadataObject'
    AccountGlossaryDetail:
      type: object
      description: This is an object of arbitrary key-value pairs for account glossary metadata that has been stored for a given account object.
      example: {
        "accountType": "normal",
        "accountStatus": "active"
      }
    EntitlementGrantGlossaryDetail:
      type: object
      description: This is an object of arbitrary key-value pairs for entitlement grant glossary metadata that has been stored for a given grant of an entitlement to an account.
      example: {
        "confidenceScore": 85
      }
    SystemAssignment:
      type: object
      description: An IGA entitlement object, which includes references to the application and raw data of the entitlement in the external system
      allOf:
        - type: object
          properties:
            id:
              type: string
              description: Entitlement Id
            entitlement:
              type: object
              description: Raw contents of the entitlement from the external system, properties will vary by entitlement and app
        - $ref: '#/components/schemas/MetadataObject'
      example: {
                "id": "system_TargetADApp___GROUP___8989f1f4-1518-49bf-8a45-7a84d3c6b17f",
                "descriptor": {
                  "idx": {
                    "/entitlement": {
                      "displayName": "Zoran Entitlement Owner"
                    }
                  }
                },
                "entitlement": {
                  "__NAME__": "Zoran Entitlement Owner",
                  "_id": "8989f1f4-1518-49bf-8a45-7a84d3c6b17f",
                  "description": "Zoran Entitlement Owner",
                  "displayName": "Zoran Entitlement Owner",
                  "id": "8989f1f4-1518-49bf-8a45-7a84d3c6b17f",
                  "mailEnabled": false,
                  "proxyAddresses": [],
                  "securityEnabled": true
                },
                "application": {
                  "id": "26523063-6d77-49b1-b0b6-e56db1ff59cf",
                  "name": "TargetADApp",
                  "description": "Test",
                  "icon": "",
                  "templateName": "azure.ad"
                },
                "applicationOwner": [
                  {
                    "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d",
                    "userName": "iga-admin",
                    "givenName": "iga",
                    "sn": "admin",
                    "mail": "sandesh.more+sm-acc-api-1010@forgerock.com"
                  }
                ],
                "entitlementOwner": [
                  {
                    "_rev": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357",
                    "accountStatus": "active",
                    "cn": "iga admin",
                    "fr": {
                      "realm": "alpha"
                    },
                    "givenName": "iga",
                    "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d",
                    "mail": "sandesh.more+sm-acc-api-1010@forgerock.com",
                    "metadata": {
                      "entityType": "/openidm/managed/user",
                      "created": "2023-10-11T14:07:19.02Z"
                    },
                    "sn": "admin",
                    "userName": "iga-admin"
                  }
                ],
                "metadata": {
                  "firstCreated": "2024-01-11T12:00:00+00:00",
                  "created": "2024-04-24T12:00:00+00:00"
                }
              }
    Event:
      type: object
      allOf:
        - $ref: '#/components/schemas/EventPayload'
        - $ref: '#/components/schemas/MetadataObject'
        - type: object
          properties: 
            id:
              type: string
              description: Unique identifier of the event
              example: 100a7fba-fd8b-47ca-bc6e-16fbec3a578d
    EventPayload:
      type: object
      description: An IGA event object, which defines a condition and action to take in that scenario
      properties:
        name:
          type: string
          description: The name of the event
          example: User Creation Event
        description:
          type: string
          description: The description of the event and its purpose
          example: This event will create an identity certification for a new user upon creation
        owners:
          type: array
          description:  This list of unique owner IDs for the event.
          items: 
            $ref: "#/components/schemas/User"
        entityType:
          type: string
          description: The type of entity for which this event applies (e.g. user, role, etc.)
          example: user
          enum:
            - user
        mutationType:
          type: string
          description: The type of mutation event on the entity, (e.g. create, update, etc.)
          example: create
          enum:
            - create
            - update
            - delete
        condition:
          type: object
          description: The condition definition for how to detect this event has occurred.
          example: {
            "version": "v2",
            "filter": {
                "and": [
                    {
                        "equals": {
                            "left": "user.after.country",
                            "right": {
                                "literal": "USA"
                            }
                        }
                    }
                ]
            }
          }
        action:
          type: object
          description: Object that defines what action will be used to respond to this event
          properties:
            type:
              type: string
              description: The type of action to be taken when event is detected
              enum:
                - orchestration
                - certification
            template:
              type: object
              description: When type is certification, this represents the certification template object that will be instantiated on event detection.
              properties:
                id:
                  type: string
                  description: ID of certification template
                  example: 8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357
            name: 
              type: string
              description: When type is workflow, the name of the workflow to instantiate on event detection
              example: IdentityCertificationKickOff
            parameters:
              type: object
              description: When type is workflow, the key value pairs that will be submitted to the workflow in question
        status:
          type: string
          description: The status of the event, active/inactive
          enum:
            - active
            - inactive
    ConditionEntities:
      type: object
      properties:
        entities:
          type: array
          items:
            type: string
            example: user
    ConditionEntitySchema:
      type: object
      properties:
        schema:
          type: object
          example:  {
            "user.after.profileImage": {
                "class": "json",
                "type": "string"
            },
            "user.before.description": {
                "class": "json",
                "type": "string"
            },
            "user.before._id": {
                "class": "json",
                "type": "string"
            },
            "user.after.manager": {
                "class": "json",
                "reference": "/openidm/managed/alpha_user",
                "type": "reference"
            },
            "user.before.postalAddress": {
                "class": "json",
                "type": "string"
            },
            "user.after.applications": {
                "class": "json",
                "item": {
                    "type": "reference",
                    "reference": "/openidm/managed/alpha_application"
                },
                "type": "array"
            },
            "user.before.accountStatus": {
                "class": "json",
                "type": "string"
            },
            "user.before.groups": {
                "class": "json",
                "item": {
                    "type": "reference",
                    "reference": "/openidm/managed/alpha_group"
                },
                "type": "array"
            },
            "user.before.adminOfOrg": {
                "class": "json",
                "item": {
                    "type": "reference",
                    "reference": "/openidm/managed/alpha_organization"
                },
                "type": "array"
            },
            "user.after.country": {
                "class": "json",
                "type": "string"
            },
            "user.after.telephoneNumber": {
                "class": "json",
                "type": "string"
            },
            "user.after.reports": {
                "class": "json",
                "item": {
                    "type": "reference",
                    "reference": "/openidm/managed/alpha_user"
                },
                "type": "array"
            },
            "user.before.frUnindexedMultivalued4": {
                "class": "json",
                "item": {
                    "type": "string"
                },
                "type": "array"
            },
            "user.before.ownerOfApp": {
                "class": "json",
                "item": {
                    "type": "reference",
                    "reference": "/openidm/managed/alpha_application"
                },
                "type": "array"
            },
            "user.before.frUnindexedMultivalued5": {
                "class": "json",
                "item": {
                    "type": "string"
                },
                "type": "array"
            },
            "user.before.frUnindexedMultivalued2": {
                "class": "json",
                "item": {
                    "type": "string"
                },
                "type": "array"
            },
            "user.after.givenName": {
                "class": "json",
                "type": "string"
            },
            "user.before.frUnindexedMultivalued3": {
                "class": "json",
                "item": {
                    "type": "string"
                },
                "type": "array"
            },
            "user.before.manager": {
                "class": "json",
                "reference": "/openidm/managed/alpha_user",
                "type": "reference"
            },
            "user.after.mail": {
                "class": "json",
                "type": "string"
            }
          }
    Scope:
      type: object
      allOf:
        - $ref: '#/components/schemas/ScopePayload'
        - $ref: '#/components/schemas/MetadataObject'
        - type: object
          properties: 
            id:
              type: string
              description: Unique identifier of the scope
              example: 100a7fba-fd8b-47ca-bc6e-16fbec3a578d
    ScopePayload:
      type: object
      description: An IGA scoping rule object, which defines target and source conditions for a scope
      properties:
        name:
          type: string
          description: The name of the scope
          example: Contractor Scope
        description:
          type: string
          description: The description of the scope and its purpose
          example: This event will create a scoping rule for users who are contractors
        status:
          type: string
          description: The status of the event, active/inactive
          enum:
            - active
            - inactive
        sourceCondition:
          type: object
          description: The conditions for this scoping rule that determine who/what the rule applies to
          properties:
            user:
              type: object
              description: The source condition for users
              example: {
                "version": "v2",
                "filter": {
                    "and": [
                        {
                            "equals": {
                                "left": "user.employeeType",
                                "right": {
                                    "literal": "contractor"
                                }
                            }
                        }
                    ]
                }
            }
        targetCondition:
          type: object
          description: The conditions for this scoping rule that determine who/what the source objects can view/access/act on/etc.
          properties:
            application:
              type: object
              description: The target condition for applications
              example: {
                "version": "v2",
                "filter": {
                    "and": [
                        {
                            "equals": {
                                "left": "application.templateName",
                                "right": {
                                    "literal": "azure.ad"
                                }
                            }
                        }
                    ]
                }
            }
            role:
              type: object
              description: The target condition for roles
              example: {
                "version": "v2",
                "filter": {
                    "and": [
                        {
                            "contains": {
                                "search_string_array": [
                                    {
                                        "literal": "contractor"
                                    },
                                    {
                                        "literal": "temp"
                                    }
                                ],
                                "in_string": "role.name"
                            }
                        }
                    ]
                }
            }
            entitlement:
              type: object
              description: The target condition for entitlements
              example: {
                "version": "v2",
                "filter": {
                    "and": [
                        {
                            "equals": {
                                "left": "entitlement.name",
                                "right": {
                                    "literal": "Directory Admin"
                                }
                            }
                        }
                    ]
                }
            }
    MetadataObject:
      type: object
      properties:
        metadata:
          type: object
          properties:
            createdDate:
              type: string
              description: The datetime that the object was originally discovered/created by IGA.
              example: 2024-01-11T12:00:00+00:00
            modifiedDate:
              type: string
              description: The datetime that the object was most recently updated.
              example: 2024-04-24T12:00:00+00:00
    RequestType:
      type: object
      properties:
        id: 
          type: string
          description: The identifier of the request type
        schemas:
          type: object
          properties:
            custom:
              type: array
              items:
                description: schema definition
                type: object
                properties:
                  _meta:
                    type: object
                    properties:
                      type:
                        type: string
                      displayName:
                        type: string
                      properties:
                        type: object
                        description: The definition of each property
                  properties:
                    type: object
                    description: The type information of each property
    Workflow:
      type: object
      properties:
        id:
          type: string
          description: ID of the workflow definition. It must to be one of the 6 seeded definitions.
        name:
          type: string
          description: Name of the workflow definition. It must to be one of the 6 seeded definitions.
        displayName:
          type: string
          description: The name that displays for the workflow definition.
        description:
          type: string
          description: The description of the workflow definition.
        type:
          type: string
          description: Provisioning is the only available type.
          enum:
            - provisioning
        steps:
          description: The order of steps. The first element in the steps array is the first step of the workflow.
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/scriptTask'
              - $ref: '#/components/schemas/approvalTask'
              - $ref: '#/components/schemas/fulfillmentTask'
            discriminator:
                propertyName: type
    scriptTask:
      type: object
      description: Script task can be used to write any custom logic in workflow.
      properties:
        name:
          type: string
          description: Name of the step.
        displayName:
          type: string
          description: Display name of the step.
        type:
          type: string
          description: This must be 'scriptTask'.
          enum:
            - scriptTask
        scriptTask:
          type: object
          description: Body of script task.
          properties:
            language:
              type: string
              description: This must be `javascript`.
              enum:
                - javascript
            gatewayType:
              type: string
              description: This can either be ‘inclusive’ or ‘exclusive’.

                If the gatewayType is  ‘exclusive’ it follows the if/else pattern. Whichever step’s condition evaluates to true first is selected.
                
                If the gatewayType is ‘inclusive’ it follows the if/if/if pattern.
                All the steps with conditions evaluate to true runs in parallel (at the same time). 
                
                When there are parallel flows that are initiated by an ‘inclusive’ gateway, they must be joined at the end by a script node with gatewayType as ‘inclusive’. This will make sure that the process will wait until every parallel path completes and reaches the join node.
              enum:
                - inclusive
                - exclusive
            script:
              type: string
              description: The javascript provided by the end user. The javascript has to be json string escaped.
              example: "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}"
            nextStep:
              type: array
              description: What are the next steps after the approval task?
              items:
                properties:
                  condition:
                    type: string
                    description: Javascript expression that resolves to either true or false. If the expression returns true, the path is taken, else it isn't.
                  outcome:
                    type: string
                    description: Human-friendly name for th outcome.
                  step:
                    type: string
                    description: Name of the next step. To connect to the end step, set this value to `null`.
    approvalTask:
      type: object
      properties:
        name:
          type: string
          description: Name the step.
        displayName:
          type: string
          description: Display name the step.
        type:
          type: string
          description: The value must be 'approvalTask'.
          enum:
            - approvalTask
        nextStep:
          type: array
          description: What are the next steps after the approval task?
          items:
            properties:
              condition:
                type: string
                description: Javascript expression that resolves to either true or false. If the expression returns true, the path is taken, else it isn't.
              outcome:
                type: string
                description: Human-friendly name for the outcome.
              step:
                type: string
                description: Name of the next step. null if you want to connect to end step
        actors:
          type: array
          description: Who are the actors / approvers for this approval task?
            
            If there are multiple actors, one of them has to take an action to register a decision for the approval task and move the process forward.
          items:
            $ref: '#/components/schemas/Actor'
        events:
          $ref: '#/components/schemas/Events'
    Actor:
      type: object
      properties:
        id:
          type: object
          description: ID of the approver.
          properties:
            value:
              type: string
              description: Value of the ID. It can be a string or an expression.
                
                An example of an expression is "\"managed/user/\" + requestIndex.applicationOwner[0].id".
                
                This assigns the approver to be the first application owner for the application grant access request type.
                
                An example of a string value is `managed/user/7174f301-dc29-4cbe-bf95-a1cba356fc6c`.
            isExpression:
              type: boolean
              description: Identifier to tell if the value is a plain string or an expression.
        permissions:
          type: object
          description: The permissions the approver can take on the access request.
          properties:
            approve:
              type: boolean
              description: Can the approver approve the access request?
            reject:
              type: boolean
              description: Can the approver reject the access request?
            reassign:
              type: boolean
              description: Can the approver reassign the access request to another user?
            modify:
              type: boolean
              description: Can the approver modify the access request?
            comment:
              type: boolean
              description: Can the approver comment on the access request?
    Events:
      type: object
      description: Notifications and frequency settings for this approval task.
      properties:
        assignment:
          type: object
          description: Assignment related settings
          properties:
            notification:
              type: string
              description: The email template used on assignment of the access request.
        reassign:
          type: object
          description: Reassignment related settings
          properties:
            notification:
              type: string
              description: The email template to use when an access request is reassigned.
        reminder:
          type: object
          description: Reminder related settings
          properties:
            notification:
              type: string
              description: The email template to use when a reminder is sent to an approver to complete an access request task.
            frequency:
              type: number
              description: How frequently (in days) the reminder is sent.
            date:
              type: object
              description: When to start sending the email. This can be a javascript expression.
              properties:
                isExpression:
                  type: boolean
                  description: Whether date is an expression or a string.
                value:
                  type: string
                  description: Value of the expression or date string. For example,
                    "(new Date(new Date().getTime()+(3*1*24*60*60*1000))).toISOString()"
        escalation:
          type: object
          description: Escalation related settings.
          properties:
            notification:
              type: string
              description: The email template to use when an access request is escalated to another user.
            actors:
              type: array
              description: Who to send the escalation email to. You can define multiple approvers (actors).
              items:
                properties:
                  id:
                    type: object
                    description: ID related settings
                    properties:
                      value:
                        type: string
                        description: Value of the ID. It can be a string or an expression.
                          
                          Example for expression.
                          
                          "\"managed/user/\" + requestIndex.applicationOwner[0].id"
                          
                          This dynamically populates the escalation point of contact as the application owner
                          However, you can easily change this to be the end user's manager. 
                          
                          An example of a string value is `managed/user/7174f301-dc29-4cbe-bf95-a1cba356fc6c`.
                      isExpression:
                        type: boolean
                        description: Whether the ID is an expression or a string.
            date:
              type: object
              description: Date when escalation happens. It can be javascript expression
              properties:
                isExpression:
                  description: Whether date is an expression or a string.
                  type: boolean
                value:
                  type: string
                  description: Value of the expression or date string.
                    "(new Date(new Date().getTime()+(7*1*24*60*60*1000))).toISOString()"

        expiration:
          type: object
          description: Expiration related settings.
          properties:
            notification:
              type: string
              description: The email template to use when the access request expires.
            actors:
              type: array
              description: The user to reassign the access request to if action is ‘reassign’.
              items:
                properties:
                  id:
                    type: object
                    description: ID related settings
                    properties:
                      value:
                        type: string
                        description: Value of the ID. It can be a string or an expression.
                          
                          Example for expression.
                          
                          "\"managed/user/\" + requestIndex.applicationOwner[0].id"
                          
                          This dynamically populates the ID to be the application owner.
                          
                          Example of string value is `managed/user/7174f301-dc29-4cbe-bf95-a1cba356fc6c`.
                      isExpression:
                        type: boolean
                        description: Whether ID is an expression or string.
                  permissions:
                    type: object
                    description: The permissions the approver can take on the access request.
                    properties:
                      approve:
                        type: boolean
                        description: Can the approver approve the access request?
                      reject:
                        type: boolean
                        description: Can the approver reject the access request?
                      reassign:
                        type: boolean
                        description: Can the approver reassign the access request?
                      modify:
                        type: boolean
                        description: Can the approver modify the access request?
                      comment:
                        type: boolean
                        description: Can the approver comment on the access request?
            date:
              type: object
              description: The date the access request expires. It can be javascript expression.
              properties:
                isExpression:
                  type: boolean
                  description: Whether date is an expression or a string.
                value:
                  type: string
                  description: Value of the expression or date string..
                    "(new Date(new Date().getTime()+(7*1*24*60*60*1000))).toISOString()"
            action:
              description: It can either be ‘reassign’ or ‘reject’.
                
                If you do not add the `action` key, the expiration takes no action when the task expires.

              type: string
    fulfillmentTask:
      type: object
      properties:
        name:
          type: string
          description: Name of the step.
        displayName:
          type: string
          description: Display name of the step.
        type:
          type: string
          description: The value must be 'approvalTask'.
          enum:
            - approvalTask
        nextStep:
          type: array
          description: What are the next steps after the approval task?
          items:
            properties:
              condition:
                type: string
                description: Javascript expression that resolves to either true or false. If the expression returns true, path will be take, else it will not be taken
              outcome:
                type: string
                description: Human-friendly name for th outcome.
              step:
                type: string
                description: Name of the next step. null if you want to connect to end step.
        actors:
          type: array
          description: Who are the actors (approvers) for this approval task?
            
            If there are multiple approvers, one must take an action to register a decision for the approval task and to move the workflow forward.

          items:
            $ref: '#/components/schemas/Actor'
        events:
          $ref: '#/components/schemas/Events'
    WorkflowResult:
        type: object
        properties:
          result:
            type: array
            description: Array of workflows
            items:
              $ref: '#/components/schemas/Workflow'
          searchAfterKey:
            type: string
            description: Elastic search after key. Used for page number.
          resultCount:
            type: number
            description: Number of items in the result
          totalCount:
            type: number
            description : Total number of items available
    ReportResult:
        type: object
        properties:
          result:
            type: array
            description: Array of Audit reports
            items:
              $ref: '#/components/schemas/Audit'
          resultCount:
            type: number
            description: Number of items in the result
          totalCount:
            type: number
            description : Total number of items available
          queryId:
            type: string
            description : Required parameter for pagination.
          dataSetId:
            type: string
            description : Required parameter for pagination.
          pageToken:
            type: string
            description : Required parameter for pagination.
    Audit:
      type: object
      properties:
        actor:
          type: string
          description: Actor
        eventType:
          type: string
          description: Type of event
        objectId:
          type: string
          description: ID of the object associated with the report.
        action:
          type: string
          description: Action of the event
        timestamp:
          type: string
          description: Date and time the event was created
        changes:
          type: array
          items:
            $ref: '#/components/schemas/AuditChange'
    AuditChange:
      type: object
      properties:
        after_value:
          type: string
          description: Value after the change
          example: New City
        before_value:
          type: string
          description: Value before the change
          example: Old City
        field_name:
          type: string
          description: Field that was changed
          example: city
    AccessGrant:
      type: object
      description: An access grant representing one of role membership, entitlement grant, or account grant.
      example: {
            "role": {
                "_rev": "9b32dc1c-c0fe-4cf6-a24c-2b9374dd15ad-820870",
                "description": "Test",
                "fr": {
                    "realm": "alpha"
                },
                "id": "7136a3c4-0c12-488a-8cfd-2fd71a24e4bd",
                "metadata": {
                    "entityType": "/openidm/managed/role",
                    "created": "2024-09-09T15:28:28.887Z"
                },
                "name": "Approver Role"
            },
            "user": {
                "_rev": "9b32dc1c-c0fe-4cf6-a24c-2b9374dd15ad-1200974",
                "accountStatus": "active",
                "cn": "Ariela Stonuary",
                "custom_debugObj": {
                    "task-started": "2024-09-04T21:08:01.019057006"
                },
                "custom_debugObjTwo": {
                    "task-completed": "2024-09-04T21:08:01.290865442"
                },
                "description": "updateNow1",
                "fr": {
                    "realm": "alpha"
                },
                "givenName": "Ariela",
                "id": "e8224d8b-a5b6-4120-83d4-fd9b69844aca",
                "mail": "Ariela@IGATestQA.onmicrosoft.com",
                "metadata": {
                    "created": "2024-09-06T15:31:18.399Z",
                    "entityType": "/openidm/managed/user",
                    "version": 7
                },
                "preferences": {
                    "marketing": false,
                    "updates": false
                },
                "sn": "Stonuary",
                "userId": "e8224d8b-a5b6-4120-83d4-fd9b69844aca",
                "userName": "Ariela@IGATestQA.onmicrosoft.com"
            },
            "catalog": {
                "id": "87b51036e699e772f9e4f81617f5e3adb6c012974a594e6aa4bc50254419be7ccf7d26c85b42df8fa7147798a75966cad432528eef9e9f32f4f78c4a4607c4c"
            },
            "compositeId": "e546e458a04626344e478139309b21f35fcba24e1f9429a19c769897d3928c66408cdd50f9e08170fb810751bd70ca929840c894e346d11126c57326e7d9a33d",
            "glossary": {
                "idx": {
                    "/role": {
                        "requestable": true,
                        "roleOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
                    }
                },
                "types": [
                    {
                        "attrKey": "/role",
                        "modified": "2024-09-12T12:51:42.108Z",
                        "type": "entityType/id/realm"
                    }
                ]
            },
            "item": {
                "type": "roleMembership"
            },
            "keys": {
                "type": "roleMembership",
                "roleId": "7136a3c4-0c12-488a-8cfd-2fd71a24e4bd",
                "userId": "e8224d8b-a5b6-4120-83d4-fd9b69844aca"
            },
            "relationship": {
                "id": "7065a955-275f-4e70-969b-4cf19c479af6-8621418",
                "conditional": false
            },
            "metadata": {
                "modifiedDate": "2024-09-12T12:57:46.847Z",
                "createdDate": "2024-09-03T13:08:13.306772183Z"
            }
        }
    AutoIdRecommendation:
      type: object
      description: A single recommendation between a given user and a piece of access (entitlement supported currently).
      example: {
        "prediction": {
            "usr_id": "44aac3af-23ae-47ad-a760-e5f4d94da54b",
            "ent_id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e",
            "confidence": 0.75,
            "rule": [
                "12_CHIEF_YES_NO_Yes",
                "12_USR_EMP_TYPE_Employee",
                "14_USR_MANAGER_ID_benjamin.rosenfield",
                "19_USR_DEPARTMENT_NAME_Customer Operations South"
            ],
            "freq": 5,
            "freqUnion": 4
        },
        "glossary": {
            "idx": {
                "/application": {
                    "requestable": true,
                    "testInt": "0"
                }
            },
            "types": [
                {
                    "attrKey": "/application",
                    "modified": "2024-06-05T22:12:51.892Z",
                    "type": "entityType/id/realm"
                }
            ]
        },
        "descriptor": {
            "idx": {
                "/entitlement": {
                    "displayName": "Customer Support - QA"
                }
            }
        },
        "entitlement": {
            "__NAME__": "Customer Support - QA",
            "_id": "ac77bdcb-659f-4276-beb9-14604d62986e",
            "displayName": "Customer Support - QA",
            "id": "ac77bdcb-659f-4276-beb9-14604d62986e",
            "mailEnabled": false,
            "securityEnabled": true
        },
        "assignment": {
            "_rev": "c528ae0a-b382-424a-8af1-f08c11af5abc-21526",
            "attributes": [
                {
                    "name": "memberOf",
                    "value": [
                        "ac77bdcb-659f-4276-beb9-14604d62986e"
                    ]
                }
            ],
            "description": "ac77bdcb-659f-4276-beb9-14604d62986e",
            "fr": {
                "realm": "alpha"
            },
            "id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e",
            "mapping": "managedAlpha_user_systemTargettestigaautom1User",
            "metadata": {
                "entityType": "/openidm/managed/assignment",
                "created": "2024-04-17T00:50:43.452Z"
            },
            "name": "Customer Support - QA",
            "type": "__ENTITLEMENT__"
        },
        "application": {
            "_rev": "c528ae0a-b382-424a-8af1-f08c11af5abc-21516",
            "authoritative": false,
            "connectorId": "Targettestigaautom1",
            "description": "Target AD App",
            "fr": {
                "realm": "alpha"
            },
            "icon": "",
            "id": "bb97f388-8c11-4314-9691-22a9f1a799df",
            "mappingNames": [
                "systemTargettestigaautom1User_managedAlpha_user",
                "systemTargettestigaautom1__group___managedAlpha_assignment",
                "managedAlpha_user_systemTargettestigaautom1User",
                "systemTargettestigaautom1Directoryrole_managedAlpha_assignment"
            ],
            "metadata": {
                "entityType": "/openidm/managed/application",
                "created": "2024-06-05T22:12:40.911Z"
            },
            "name": "Targettestigaautom1",
            "templateName": "azure.ad",
            "templateVersion": "2.2"
        },
        "catalog": {
            "id": "81cbcb5edbb422f68b5407ccf0987714c6418051fffdb132649eafaa4b436d02f4402a9820d48af843230186cfb033ec4e21431778ef1796fef2ad47423957e0"
        },
        "keys": {
            "usr_id": "44aac3af-23ae-47ad-a760-e5f4d94da54b",
            "ent_id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e"
        },
        "compositeId": "bae206ad1fa95d701344e2a7050cd2ee54e607d4fe1da2cdcd2b07b6522b5deafb1ab03326d95f18b6ca659fa0a84539ce3cb54a80ddbf6f7284e73e4caec274",
        "latestCreationTime": 1731096658.93
      }
    Certification:
      allOf:
        - $ref: '#/components/schemas/CertificationTemplate'
        - type: object
          properties:
            templateId:
              type: string
              description: ID of the template the certification was created from
            startDate:
              type: string
              description: Date time that the certification was created
            deadline:
              type: string
              description: Date time that the certification will end
            completionDate:
              type: string
              description: Date time that the certification completed
            completedBy:
              type: object
              description: Information on the user that completed this certification (e.g., user who canceled cert)
            expirationNotificationDate:
              type: string
              description: Next date that an expiration notification will be sent
            reminderNotificationDate:
              type: string
              description: Next date that a reminder notification will be sent
            escalationNotificationDate:
              type: string
              description: Next date that an escalation notification will be sent
            etlJobId:
              type: string
              description: ID of the ETL job that creates the items for this campaign.
            status:
              type: string
              description: Current state of campaign
              enum:
                - in-progress
                - complete
                - staging
                - cancelled
            systemMessages:
              type: object
              description: List of any system messages that pertain to this certification instance.
              properties:
                info:
                  type: array
                  description: Non-error related informational messages
                  items:
                    type: object
                errors:
                  type: array
                  description: Error related messages
                  items:
                    type: object
    CertificationTemplate:
      description: A certification template contains all of the details required to create a new certification campaign instance
      allOf:
        - $ref: '#/components/schemas/CertificationTemplateCreation'
        - type: object
          properties:
            status:
              type: string
              description: Status of the certification template, pending templates may be edited.
              enum:
                - active
                - pending
            scheduleId:
              type: string
              description: ID for the schedule that runs this template
            ownerInfo:
              type: object
              description: Certification owner information
              properties:
                id:
                  type: string
                  description: ID of owner (full ID e.g., managed/user/003)
                userName:
                  type: string
                  description: userName of owner
                mail:
                  type: string
                  description: Email address of owner
                givenName:
                  type: string
                  description: Given name of owner
                sn:
                  type: string
                  description: Surname of owner
            defaultCertifierInfo:
              type: object
              description: Default certifier information
              properties:
                id:
                  type: string
                  description: ID of default certifier (full ID e.g., managed/user/003)
                userName:
                  type: string
                  description: userName of default certifier
                mail:
                  type: string
                  description: Email address of default certifier
                givenName:
                  type: string
                  description: Given name of default certifier
                sn:
                  type: string
                  description: Surname of default certifier
            escalationOwnerInfo:
              type: object
              description: Escalation owner information
              properties:
                id:
                  type: string
                  description: ID of escalation owner (full ID e.g., managed/user/003)
                userName:
                  type: string
                  description: userName of escalation owner
                mail:
                  type: string
                  description: Email address of escalation owner
                givenName:
                  type: string
                  description: Given name of escalation owner
                sn:
                  type: string
                  description: Surname of escalation owner
            expirationReassigneeInfo:
              type: object
              description: Expiration reassignee information
              properties:
                id:
                  type: string
                  description: ID of reassignee (full ID e.g., managed/user/003)
                userName:
                  type: string
                  description: userName of reassignee, when reassignee is user
                mail:
                  type: string
                  description: Email address of reassignee, when reassignee is user
                givenName:
                  type: string
                  description: Given name of reassignee, when reassignee is user
                sn:
                  type: string
                  description: Surname of reassignee, when reassignee is user
                name:
                  type: string
                  description: Name of reassignee, when reassignee is role
    CertificationTemplateCreation:
      type: object
      description: The payload that the create template endpoint takes and uses to generate a certification template object.
      properties:
        id:
          type: string
          description: ID of template
        name:
          type: string
          description: Campaign template name
        description:
          type: string
          description: Description of the certification template
        certificationType:
          type: string
          description: Type of certification (identity, etc.)
          enum:
            - identity
        ownerId:
          type: string
          description: Owner of the certification
        schedule:
          $ref: '#/components/schemas/Schedule'
        targetFilter:
          $ref: '#/components/schemas/TargetFilter'
        stages:
          type: array
          description: List of stage definitions
          items:
            $ref: '#/components/schemas/CertificationStage'
        stageDuration:
          type: integer
          description: Duration of stage in days
        expirationAction:
          type: string
          description: Action to take on certification line items on expiration
          enum:
            - certify
            - revoke
            - exception
            - reassign
            - none
        expirationActionDelay:
          type: string
          description: Duration to wait before taking expiration action in days
        expirationReassignee:
          type: string
          description: User or role to reassign task to on expiration
        stagingEnabled:
          type: boolean
          description: If enabled, certification will sit in staging phase until activated
        defaultCertifierId:
          type: string
          description: ID of user that will be assigned as certifier when one cannot be calculated
        allowBulkCertify:
          type: boolean
          description: Allow users to bulk certify line items in this campaign
        allowPartialSignoff:
          type: boolean
          description: Allow users to sign off decision items in a campaign before all have been acted on
        remediationRule:
          type: string
          description: Script to run on sign off of line items; for example calling an external workflow
        remediationDelay:
          type: integer
          description: Duration to wait in days before executing remediation
        exceptionDuration:
          type: integer
          description: Maximum length of time, in days, that exceptions are allowed on line items
        enableForward:
          type: boolean
          description: Enable certifier forwarding of line items
        enableReassign:
          type: boolean
          description: Enable certifier reassign of line items
        reassignPermissions:
          $ref: '#/components/schemas/CertificationPermissions'
        selfCertificationRule:
          type: string
          description: What users can certify their own access (restricted is owners/admins only)
          enum:
            - all
            - restricted
            - none
        assignmentNotification:
          type: string
          description: Notification template to send to certifier on assignment
        reassignNotification:
          type: string
          description: Notification template to send to new certifiers on re-assignment
        expirationNotification:
          type: string
          description: Notification template to send to certifier on expiration
        expirationNotificationDay:
          type: string
          description: Length of time, in days, before a certification expires that an expiring notification is sent out to users.
        reminderNotification:
          type: string
          description: Notification template to send to certifier as a reminder
        reminderFrequency:
          type: integer
          description: How often to send reminder notification to certifier
        escalationNotification:
          type: string
          description: Notification template to send to escalation owner
        escalationFrequency:
          type: integer
          description: How often to send escalation notifications, in days
        escalationOwner:
          type: string
          description: ID of owner who receives escalation notifications
        excludeConditionalAccess:
          type: boolean
          description: Exclude role memberships that are granted conditionally
        excludeRoleBasedAccess:
          type: boolean
          description: Exclude entitlement or account grants that are granted via role
        includeChildOrganizations:
          type: boolean
          description: When organizations are provided in the filter, also include child organizations of those provided
        parameters:
          type: array
          description: List of parameters this campaign template expects to be provided at runtime
          items:
            $ref: '#/components/schemas/CertificationTemplateParameter'
        templateEventType:
          type: string
          description: For event based templates, this is the type of entity the event references
          enum:
          - user
    CertificationStage:
      type: object
      properties:
        name:
          type: string
          description: Name of the stage
        certifierType:
          type: string
          description: Type of certifier for the stage
          enum:
            - user
            - authzGroup
            - manager
            - entitlementOwner
            - prevManager
            - script
        certifierId:
          type: string
          description: ID of the certifier of the stage
      description: Stage definition within a certification object.
    CertificationPermissions:
      type: object
      description: Permissions certification actor has assigned to them
      properties:
        certify:
          type: boolean
          description: Can user take certify action
        comment:
          type: boolean
          description: Can user take comment action
        exception:
          type: boolean
          description: Can user take grant exception action
        forward:
          type: boolean
          description: Can user take forward action
        reassign:
          type: boolean
          description: Can user take reassign action
        reset:
          type: boolean
          description: Can user take reset action
        revoke:
          type: boolean
          description: Can user take revoke action
        signoff:
          type: boolean
          description: Can user take signoff action
    CertificationTemplateParameter:
      type: object
      properties:
        id:
          type: string
          description: Identifier of parameter used in creation payload
        displayName:
          type: string
          description: Display friendly name for parameter
        path:
          type: string
          description: If provided, the direct path at which the value provided during campaign creation should be placed
    Schedule:
      type: object
      properties:
        id:
          type: string
          description: ID of the scheduled job object
        type:
          type: string
          description: Type of schedule defined
          enum:
            - simple
            - cron
        startTime:
          type: string
          description: Date/time that the scheduled job will first execute
        endTime:
          type: string
          description: Date/time that the scheduled job will stop executing
        repeatCount:
          type: integer
          description: Number of times that the scheduled job will execute, -1 to run forever
        repeatInterval:
          type: integer
          description: Time, in milliseconds, between runs
        schedule:
          type: string
          description: Cron string defining the schedule
        invokeContext:
          type: object
          description: Action taken when run
        enabled:
          type: boolean
          description: Is schedule enabled
    TargetFilter:
      type: object
      properties:
        account:
          $ref: '#/components/schemas/TargetFilterNode'
        application:
          $ref: '#/components/schemas/TargetFilterNode'
        assignment:
          $ref: '#/components/schemas/TargetFilterNode'
        role:
          $ref: '#/components/schemas/TargetFilterNode'
        user:
          $ref: '#/components/schemas/TargetFilterNode'
      example: { 
        "user": {
          "operator": "EQUALS",
          "operand": {
            "targetName": "accountStatus",
            "targetValue": "active"
          }
        },
        "application": {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "name",
            "targetValue": "SalesForce"
          }
        },
        "type": [ "accountGrant" ],
        "memberOfOrg": [ "52cf01b4-288e-4c21-aed6-f992be073988" ]
      }
    CertificationSingle:
      type: object
      description: Certification campaign instance with additional properties when queried directly
      allOf:
        - $ref: '#/components/schemas/Certification'
        - type: object
          properties:
            totalTargets:
              type: integer
              description: total number of targets (users/roles/etc.)
            totalItems:
              type: integer
              description: Total number of line items to be certified
            totalItemsComplete:
              type: integer
              description: Total number of line items to be certified
            percentItemsComplete:
              type: integer
              description: Percentage of items complete
    CertificationLineItem:
      allOf:
        - type: object
          properties:
            id:
              type: string
              description: ID of the line item
            decision:
              type: object
              description: Decision container
              properties:
                certification:
                  $ref: '#/components/schemas/CertificationDecisionItem'
    CertificationDecisionItem:
      type: object
      properties:
        campaignId:
          type: string
          description: ID of the campaign instance line item belongs to
        targetId:
          type: string
          description: ID of the all items index entry being certified
        status:
          type: string
          description: Status of the line item
          enum:
            - in-progress
            - signed-off
            - pending
            - cancelled
            - expired
        decision:
          type: string
          description: Decision taken on the line item
          enum:
            - certify
            - revoke
            - exception
        completionDate:
          type: string
          description: Date time the line item was signed off
        completedBy:
          type: object
          description: Information of the user who signed off on the decision
        decisionDate:
          type: string
          description: Date time the line item decision was made
        decisionBy:
          type: object
          description: Information of the user who made the decision on the item
        remediationDate:
          type: string
          description: Date time the line item remediation will occur
        remediated:
          type: boolean
          description: Has remediation occurred succesfully
        remediationStatus:
          type: string
          description: Outcome of the remediation process
          enum:
            - pending
            - failed
            - in-progress
            - complete
        confidenceScore:
          type: integer
          description: Confidence score
        stageIndex:
          type: integer
          description: Index of stage in campaign
        deadline:
          type: string
          description: Date time this line item must be completed by
        isExpired:
          type: boolean
          description: Flag used for the expiration scan. Set to true after scan run.
        comments:
          type: array
          description: List of comments added to the line item.
          items:
            $ref: '#/components/schemas/Comment'
        actors:
          type: array
          description: List of users who have permissions to act on this item
          items:
            $ref: '#/components/schemas/CertificationActor'
    CertificationActor:
      allOf:
        - $ref: '#/components/schemas/Actor'
        - type: object
          properties:
            id:
              type: string
              description: ID of actor (full ID e.g., managed/user/003 or managed/role/123)
            userName:
              type: string
              description: userName of actor, when actor is user
            mail:
              type: string
              description: Email address of actor, when actor is user
            givenName:
              type: string
              description: Given name of actor, when actor is user
            sn:
              type: string
              description: Surname of actor, when actor is user
            name:
              type: string
              description: Name of actor, when actor is role
            permissions:
              $ref: '#/components/schemas/CertificationPermissions'
    LineItemActionMessage:
      properties:
        message:
          type: string
          description: 'Action Completed succesfully'
        idsNotActedOn:
          type: array
          items:
            type: string
    TemplateDuplicateReturn:
      type: object
      properties:
        message:
          type: string
          enum: ['Cert Template duplicated successfully']
    CampaignTask:
      type: object
      description: An individual campaign task that is assigned to an end user, appears on their dashboard.
      example: {
            "status": "in-progress",
            "campaignId": "19cf170e-5dd8-4159-a467-c4f018f1a0c8",
            "certifierId": "managed/user/f7089551-b8c6-402f-a4f7-5f8f0724ff30",
            "startDate": "2024-11-19T17:52:30+00:00",
            "deadline": "2024-12-03T17:52:30+00:00",
            "campaignName": "Quarterly Review",
            "totals": {
                "in-progress": 53,
                "total": 53
            },
            "progress": 0,
            "certifier": {
                "givenName": "Bernice",
                "id": "f7089551-b8c6-402f-a4f7-5f8f0724ff30",
                "mail": "Bernice@IGATestQA.onmicrosoft.com",
                "sn": "Hablot",
                "userName": "Bernice@IGATestQA.onmicrosoft.com",
                "type": "user",
                "key": "managed/user/f7089551-b8c6-402f-a4f7-5f8f0724ff30"
            }
        }
    BulkBaseViolationsRequest:
      type: object
      required:
        - ids
      properties:
        ids:
          type: array
          description: An array of all violation ids to act on.
          items:
            type: string
          example: ["e9e4d260-1b55-4331-8468-5824344b8bc3",
              "01d8ccf0-e132-49f1-9c82-c52a6fea0154"]
        comment:
          type: string
          description: Comment or justification for this action.
          example: Justification for this action.
    BulkCommentViolationsRequest:
      allOf:
        - $ref: '#/components/schemas/BulkBaseViolationsRequest'
      type: object
      required:
        - comment
    BulkExceptionViolationsRequest:
      allOf:
        - $ref: '#/components/schemas/BulkBaseViolationsRequest'
      required:
        - exceptionExpirationDate
      type: object
      properties:
        exceptionExpirationDate:
          type: string
          description: Date that exception will expire
          example: "2024-04-24T20:36:14+00:00"
    BulkReassignViolationsRequest:
      allOf:
        - $ref: '#/components/schemas/BulkBaseViolationsRequest'
      required:
        - updatedActors
      type: object
      properties:
        updatedActors:
          type: array
          items:
            $ref: '#/components/schemas/ViolationActor'
    BulkViolationRequest:
      required:
        - id
        - phaseName
      type: object
      description: Object required to perform an action over the bulk APIS
      properties:
        id:
          type: string
          description: Violation ID
          example: 468332b1-d40d-4118-8289-5b2b6bfa7367
        phaseName:
          type: string
          description: Phase name
          example: violationTask-df7f65b04ec3
    BulkViolationResponse:
      required:
        - message
        - idsNotActedOn
      type: object
      properties:
        message:
          type: string
          description: Message indicating that the action was complete.
          example: Action 'allow' complete.
        idsNotActedOn:
          type: array
          description: An array of the violations that could not be acted on.
          items:
            $ref: '#/components/schemas/BulkViolationErrorResponse'
    BulkViolationErrorResponse:
      required:
        - id
        - errorMessage
        - errorCode
      properties:
        id:
          type: string
          description: Violation ID
          example: 09e01632-b22f-407b-bacb-aa1e2cac8214
        errorMessage:
          type: string
          description: Message describing the error for the violation ID.
          example: This violation is not eligible to be allowed.
        errorCode:
          type: integer
          description: HTTP status code representing the error for the violation ID.
          example: 400
    Policy:
      required:
        - id
      allOf:
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the policy.
            scheduleId:
              type: string
              description: ID of schedule that this policy runs on
              example: policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1
        - $ref: '#/components/schemas/PolicyBody'
    PolicyBody:
      required:   
      - name
      - policyOwner
      - policyRuleIds
      type: object
      description: A policy is a set of policy rules that are grouped together for the purposes of scanning for rule violations.
      properties:
        name:
          type: string
          description: The name of the policy
        description:
          type: string
          description: A description of the policy
        policyOwner:
          type: object
          description: The policy owner object  
          properties:
            id:
              type: string
              description: The ID of the policy owner, should be in long format (managed/user/[id])
        policyRuleIds:
          type: array
          description: The list of policy rule IDs that this policy contains.
          items:
            type: string
    PolicyRequest:
      allOf:
        - $ref: '#/components/schemas/PolicyBody'
        - type: object
          properties:
            schedule:
              type: object
              description: The contents of the schedule on which this policy is scanned. Contents TBD
              properties:
                type:
                  type: string
                  enum: [ simple ]
                  example: simple
                scheduled:
                  type: boolean
                  example: true
                schedule:
                  type: string
                repeatInterval:
                  type: integer
                  example: 864000000
                repeatCount:
                  type: integer
                  example: -1
                startTime:
                  type: string
                  example: "2023-12-21T22:41:00.000Z"
                endTime:
                  type: string
                  example: "2024-01-01T22:41:00.000Z"
    PolicyRule:
      required:
        - id
        - ruleDefinitionTags
      allOf:
        - $ref: '#/components/schemas/PolicyRuleBody'
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the policy rule.
            ruleDefinitionTags:
              type: array
              description: An array of string tags generated from the rule definition contents, to allow specific queries to be run against policy rules based on the access they target.
              items:
                type: string
              example: ["targetName=entitlement.displayName&targetValue=IT%20Admin",
                "targetValue=IT%20Admin&targetName=entitlement.displayName"]
    PolicyRuleBody:
      required:
      - name
      - policyRuleOwner
      - violationOwner
      - active
      - ruleDefinition
      - userFilter
      - maxExceptionDuration
      - scanTypes
      - decisionOptions
      - remediation
      - workflow
      - violationOwnerType
      type: object
      description: A policy rule is the definition of a segregation of duty violation, including the expressions which defines the violation's queries, the users/groups who maintain the rule, and the remediation rules and actions surrounding users who violate the rule.
      properties:
        name:
          type: string
          description: The name of the policy rule
        description:
          type: string
          description: A description of the policy rule
        documentationUrl:
          type: string
          description: A URL pointing towards any supporting documentation on the policy rule
        policyRuleOwner:
          type: object
          description: The policy rule owner object  
          properties:
            id:
              type: string
              description: The ID of the policy rule owner, should be in long format (managed/user/[id])
        violationOwner:
          type: object
          description: The violation owner object  
          properties:
            id:
              type: string
              description: The ID of the violation owner, should be in long format (managed/user/[id])
        active:
          type: boolean
          description: Whether the policy rule is currently enabled.
        scanTypes:
          type: object
          description: Lists the types of scan for which this policy rule is eligible to be included in
          properties:
            preventative:
              type: boolean
              description: Is this policy rule included in pre-assignment scans
            detective:
              type: boolean
              description: Is this policy rule included in scans of existing access
        maxExceptionDuration:
          type: integer
          description: Maximum duration in days that exceptions are allowed on violations
        decisionOptions:
          type: object
          description: Decisions that are available for the remediation actors to take
          properties:
            allow:
              type: boolean
              description: Remediation actor can choose to allow this violating access to remain in perpetuity
            exception:
              type: boolean
              description: Remediation actor can choose to grant a temporary exception to the violating access for x number of days.
            remediate:
              type: boolean
              description: Remediation actor can choose to remediate the violating access, by way of choosing one of the provided remediation options.
        remediation:
          type: object
          description: The defined remediation options for this policy rule
          properties:
            type:
              type: string
              description: The type of remediation process used by this policy rule. (e.g., BPMN)
            id:
              type: string
              description: The ID of the remediation process to use for this policy rule
            schemas:
              type: array
              items:
                type: string
                description: The IDs of the remediation schema objects that define this policy rule's remediation options.
        userFilter:
          description: An additional filter expression that is applied to policy rule evaluation to allow for targeting a specific user subset
          $ref: '#/components/schemas/TargetFilterNode'
        ruleDefinition:
          type: array
          description: An array of conditions that define the policy rule's targeted combination of access
          items:
            $ref: '#/components/schemas/TargetFilterNode'
        workflow:
          type: object
          description: Drives the lifecycle of the violations that are created.
          properties:
            type:
              type: string
              description: Type of workflow
              enum: [ bpmn ]
              example: bpmn
            id:
              type: string
              description: ID of the workflow associated.
              example: BasicViolationProcess
        violationOwnerType:
          type: string
          enum: [ user, role ]
          description: Violation owner type
          example: user
    PolicyRulesResult:
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/PolicyRule'
    PolicyScan:
      type: object
      description: A policy scan is the results from a given policy or policy rule scan
      properties:
        id:
          type: string
          description: ID of the scan object
        policy:
          description: The policy object scanned, if scan was targeting a policy
          $ref: '#/components/schemas/Policy'
        policyRule:
          description: The policy rule object scanned, if scan was targeting a single policy rule
          $ref: '#/components/schemas/PolicyRule'
        isSimulation:
          type: boolean
          description: Was the policy scan a simulated scan (i.e., no violations were created from it)
        status:
          type: string
          description: Status of the scan (in-progress, complete)
        startDate:
          type: string
          description: Date/time scan began
        completionDate:
          type: string
          description: Date/time scan completed
        scanTarget:
          type: string
          description: What object did the scan target (policy or policyRule)
        results:
          type: array
          description: Contents of scan results
          items:
            type: object
    Violation:
      required:
        - id
      allOf:
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the violation
        - $ref: '#/components/schemas/ViolationBody'
    ViolationBody:
      required:   
      - name
      type: object
      description: A violation is a single object representing a segregation of duty violation between a single policy rule and a single violating entity (user).
      properties:
        user:
          type: object
          description: Information about user who caused violation
        policyRule:
          type: object
          description: The contents of the policy rule violated
        decision:
          $ref: '#/components/schemas/ViolationDecision'
    ViolationDecision:
      type: object
      description: The decision contents of the violation
      properties:
        status:
          type: string
          enum: [ pending, in-progress, complete, cancelled, expired,]
          description: The current status of the violation
        decision:
          type: string
          enum: [ exception, revoke, deactivate]
          description: The decision taken on the violation
        comments:
          type: array
          items:
            type: object
          description: List of comments added to the violation.
        events:
          type: object
          description: The events definitions for this violation
          properties:
            assignment:
              type: object
            expiration:
              type: object
            escalation:
              type: object
            reminder:
              type: object
        actors:
          type: object
          description: Actor lists of users/roles that have permissions to act on the violation
          properties:
            active:
              type: array
              items:
                type: object
            inactive:
              type: array
              items:
                type: object
        completionDate:
          type: string
          description: Date violation was completed
        completedBy:
          type: object
          description: Info of user who completed decision
    ViolationActor:
      allOf:
      - $ref: '#/components/schemas/Actor'
      - type: object
        properties:
          permissions:
            $ref: '#/components/schemas/ViolationPermissions' 
    ViolationPermissions:
      type: object
      description: Permissions violation actor has assigned to them
      properties:
        allow:
          type: boolean
          description: Can user take allow action
        comment:
          type: boolean
          description: Can user take comment action
        exception:
          type: boolean
          description: Can user take grant exception action
        reassign:
          type: boolean
          description: Can user take reassign action
        remediate:
          type: boolean
          description: Can user take remediation action