Oracle Access Governance REST APIs

List Identities

get

/access-governance/identities/20250331/identities

Returns all active identities (Workforce and Consumers) details with support for pagination.

Request

Query Parameters

attributeValues: array[string]

Collection Format: multi

Maximum Number of Items: 5

A list of attribute values to use as matching filters.
attributes: array[string]

Collection Format: multi

Maximum Number of Items: 5

The list of Attributes used to filter.
bindingOperator: string

A parameter to bind expressions.

Default Value: ALL

Allowed Values: [ "ALL", "ANY" ]
consumerFilter: string

A filter for consumer/workforce types.

Allowed Values: [ "CONSUMER", "WORKFORCE" ]
keywordContains: array[string]

Collection Format: multi

Maximum Number of Items: 5

The list of keywords to filter on
limit: integer

Minimum Value: 1

Maximum Value: 1000

The maximum number of items to return.

Default Value: 10
operators: array[string]
Collection Format: multi

Maximum Number of Items: 5

A parameter to form logical expressions.
- Allowed Values: [ "EQ", "NE", "GT", "LT", "GTE", "LTE", "BEFORE", "AFTER", "TO", "FROM", "CONTAINS", "NOT_CONTAINS" ]
page: string

Minimum Length: 1

A token representing the position at which to start retrieving results. This must come from the `opc-next-page` header field of a previous response.
sortBy: string

The field to sort by. Only one sort order may be provided. Default order for timeCreated is descending. Default order for displayName is ascending.

Default Value: timeCreated

Allowed Values: [ "timeCreated", "displayName" ]
sortOrder: string

The sort order to use, either 'ASC' or 'DESC'.

Allowed Values: [ "ASC", "DESC" ]

Header Parameters

opc-request-id: string

The client request ID for tracing. The only valid characters for request IDs are letters, numbers, underscore, and dash.

Response

Supported Media Types

application/json

200 Response

The list of Identities successfully queried.

Headers

opc-next-page: string

For pagination of a list of items. When paging through a list, if this header appears in the response, then a partial list might have been returned. Include this value as the `page` parameter for the subsequent GET request to get the next batch of items.
opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : AccessGovernanceTypeCollection

Type: object

A list of Access Governance Entity items.

Show Source

items(required): array items

List of Access Governance Entity items.

{
    "type":"object",
    "required":[
        "items"
    ],
    "properties":{
        "items":{
            "type":"array",
            "description":"List of Access Governance Entity items.",
            "items":{
                "$ref":"#/definitions/AccessGovernanceEntity"
            }
        }
    },
    "description":"A list of Access Governance Entity items."
}

Nested Schema : items

Type: array

List of Access Governance Entity items.

Show Source

Array of: object AccessGovernanceEntity

An Access Governance Entity

{
    "type":"array",
    "description":"List of Access Governance Entity items.",
    "items":{
        "$ref":"#/definitions/AccessGovernanceEntity"
    }
}

Nested Schema : AccessGovernanceEntity

Type: object

An Access Governance Entity

Show Source

entityType(required): string

The Entity type in Access Governance
id(required): string

The Id for Access Governance Entity
isRuleBased: boolean

Is this identity ruled based
name(required): string

The name for Access Governance Type
timeCreated(required): string(date-time)

Time when entity was created by Access Governance
timeUpdated(required): string(date-time)

Time when entity was last modified by Access Governance
type(required): string

Allowed Values: [ "IDENTITY", "IDENTITY_COLLECTION", "ORGANIZATION", "ROLE", "PERMISSION", "ACCESS_BUNDLE", "POLICY", "RESOURCE", "CLOUD_RESOURCE", "ACCOUNT", "OWNERSHIP", "APPROVAL_PROCESS", "TARGET", "ACCESS_GUARDRAIL" ]

The Access Governance Entity Type
value(required): string

The json schema for Access Governance Type
violationDetails(required): object ViolationDetails

The Violation details object

{
    "type":"object",
    "required":[
        "entityType",
        "id",
        "name",
        "timeCreated",
        "timeUpdated",
        "type",
        "value",
        "violationDetails"
    ],
    "properties":{
        "id":{
            "type":"string",
            "description":"The Id for Access Governance Entity"
        },
        "type":{
            "type":"string",
            "description":"The Access Governance Entity Type",
            "enum":[
                "IDENTITY",
                "IDENTITY_COLLECTION",
                "ORGANIZATION",
                "ROLE",
                "PERMISSION",
                "ACCESS_BUNDLE",
                "POLICY",
                "RESOURCE",
                "CLOUD_RESOURCE",
                "ACCOUNT",
                "OWNERSHIP",
                "APPROVAL_PROCESS",
                "TARGET",
                "ACCESS_GUARDRAIL"
            ],
            "x-obmcs-top-level-enum":"#/definitions/EntityType"
        },
        "name":{
            "type":"string",
            "description":"The name for Access Governance Type"
        },
        "timeCreated":{
            "type":"string",
            "format":"date-time",
            "description":"Time when entity was created by Access Governance"
        },
        "timeUpdated":{
            "type":"string",
            "format":"date-time",
            "description":"Time when entity was last modified by Access Governance"
        },
        "isRuleBased":{
            "type":"boolean",
            "description":"Is this identity ruled based"
        },
        "entityType":{
            "type":"string",
            "description":"The Entity type in Access Governance"
        },
        "value":{
            "type":"string",
            "description":"The json schema for Access Governance Type"
        },
        "violationDetails":{
            "$ref":"#/definitions/ViolationDetails"
        }
    },
    "description":"An Access Governance Entity"
}

Nested Schema : ViolationDetails

Type: object

The Violation details object

Show Source

accessGuardrailViolationId(required): string

The access guardrail violation id
violationType(required): string

Allowed Values: [ "NO_VIOLATION", "LOW_RISK_ACCESS_GUARDRAIL_VIOLATION", "HIGH_RISK_ACCESS_GUARDRAIL_VIOLATION", "VIOLATION_NOT_AVAILABLE" ]

The Violation type in Access Governance

{
    "type":"object",
    "required":[
        "accessGuardrailViolationId",
        "violationType"
    ],
    "properties":{
        "violationType":{
            "type":"string",
            "description":"The Violation type in Access Governance",
            "enum":[
                "NO_VIOLATION",
                "LOW_RISK_ACCESS_GUARDRAIL_VIOLATION",
                "HIGH_RISK_ACCESS_GUARDRAIL_VIOLATION",
                "VIOLATION_NOT_AVAILABLE"
            ],
            "x-obmcs-top-level-enum":"#/definitions/ViolationType"
        },
        "accessGuardrailViolationId":{
            "type":"string",
            "description":"The access guardrail violation id"
        }
    },
    "description":"The Violation details object"
}

400 Response

Bad Request

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

401 Response

Unauthorized

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

404 Response

Not Found

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

409 Response

Conflict

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

429 Response

Too Many Requests

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

500 Response

Internal Server Error

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

Default Response

Unknown Error

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

Examples

The following example shows how to retrieve a list of Identities by submitting a GET request.

cURL Example - Without Query Parameters

curl -i -X \
 GET \
 -H \
 "Authorization:Bearer <your access token>" \
 '${service-instance-url}/access-governance/identities/${versionId}/identities'

Rules for Querying Identity Data using attributeValues

The attributeValues parameter works with the attribute parameter. So, both attributes and attributeValues must be specified and must match in number.
The keywordContains and attributeValues parameters cannot be used in the same query.
The bindingOperator determines how multiple attribute conditions are combined. ALL (all conditions must be true) and ANY, atleast one condition must be true.
Operators define the comparison between an attribute and its value. The default is EQ (equals).

Example 1 - With Query Parameters

cURL command to restrict the data and include only Workforce Identities.

curl -i -X GET \
   -H "Authorization:Bearer <your access token>" \
 '${service-instance-url}/access-governance/identities/${versionId}/identities?consumerFilter=WORKFORCE'

Example 2 - Query Identities with Attributes and Attribute Values

cURL command to query Identities with familyName CONTAINS Clark and agRisk.value EQ 1

curl -i -X GET \
   -H "Authorization:Bearer <your access token>" \
 '${service-instance-url}/access-governance/identities/${versionId}/identities?attributes=name.familyName&operators=CONTAINS&attributeValues=Clark&attributes=agRisk.value&operators=EQ&attributeValues=1'

attributes=name.familyName,agRisk.value: Specifies the attributes to filter on.
operators=CONTAINS,EQ
attributeValues=Clark,1: Provides the corresponding values.

Example 3 - Query Identities with Custom Attributes and Binding Operator and Attribute Values

curl -i -X GET \
   -H "Authorization:Bearer <your access token>" \
 '${service-instance-url}/access-governance/identities/${versionId}/attributes=customAttributes.Division&operators=EQ&attributeValues=Finance&attributes=agRisk.value&operators=EQ&attributeValues=1&bindingOperator=ALL'

Example of the Response Body

The following example shows the contents of the response body in JSON format, including a list Workforce identities:

{
  "items": [
    {
      "id": "globalId.ICF.xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxxxxxxxxxx",
      "type": "IDENTITY",
      "name": "jclark_admin",
      "timeCreated": "2025-05-29T13:39:32.244Z",
      "timeUpdated": "2025-05-29T13:39:32.244Z",
      "entityType": "USER",
      "typeDetails": "https://your-api-endpoint/access-governance/identities/yyyyMMdd/types/agcs.Identity",
      "attributes": [
        {
          "name": "agTerminated",
          "value": false
        }
      ],
      "value": "{\"name\":{\"familyName\":\"Clark\",\"givenName\":\"James\"},\"userName\":\"jclark_admin\",\"displayName\":\"James Clark\",\"primaryEmail\":\"jclark_admin@example.com\",\"employeeNumber\":\"JCLARK123\",\"status\":\"Active\",\"emails\":[{\"value\":\"jclark_admin@example.com\"}],\"addresses\":[{}],\"agStatus\":\"AG_ACTIVE\",\"agSubType\":\"WORKFORCE\",\"agRisk\":{\"value\":1,\"customAttributes\":{}},\"customAttributes\":{\"Company\":\"TestCorp\",\"BadgeNumber\":\"123\"},\"id\":\"globalId.ICF.xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxxxxxxxxxx\",\"externalId\":\"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\"meta\":{\"resourceType\":\"USER\",\"created\":1748525972244,\"lastModified\":1748525972244,\"version\":\"1\",\"location\":\"\"}}"
    },
    {
      "id": "globalId.ICF.xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxxxxxxxxxx",
      "type": "IDENTITY",
      "name": "bclark_user",
      "timeCreated": "2025-05-29T13:39:32.244Z",
      "timeUpdated": "2025-05-29T13:39:32.244Z",
      "entityType": "USER",
      "typeDetails": "https://your-api-endpoint/access-governance/identities/yyyyMMdd/types/agcs.Identity",
      "attributes": [
        {
          "name": "agTerminated",
          "value": false
        }
      ],
      "value": "{\"name\":{\"familyName\":\"Clark\",\"givenName\":\"Bill\"},\"userName\":\"bclark_user\",\"displayName\":\"Bill Clark\",\"primaryEmail\":\"bclark_user@example.com\",\"status\":\"Active\",\"emails\":[{\"value\":\"bclark_user@example.com\"}],\"addresses\":[{}],\"agStatus\":\"AG_ACTIVE\",\"agSubType\":\"WORKFORCE\",\"agRisk\":{\"value\":1,\"customAttributes\":{}},\"customAttributes\":{\"Company\":\"TestCorp\",\"BadgeNumber\":\"456\"},\"id\":\"globalId.ICF.xxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxxxxxxxxxx\",\"externalId\":\"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\"meta\":{\"resourceType\":\"USER\",\"created\":1748525972244,\"lastModified\":1748525972244,\"version\":\"1\",\"location\":\"\"}}"
    }
  ]
}