Update Pre Approval Rule
Update a pre-approval rule by ID.
A field you leave out keeps the rule’s current value, and a field you set to null is cleared. The three entitlements fields are replaced together. Send the one that applies, or send only null values to make the rule cover only a request for the app itself.
Returns 400 with Entitlement ID invalid if an entitlement ID doesn’t exist, belongs to another app, or can’t be requested.
Returns 409 if the rule is limited by an access policy. Also returns 409 if this API can’t represent the access the rule covers, unless the request replaces the rule’s entitlements fields.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Request body for updating a pre-approval rule. A field you leave out keeps the rule's
current value, and a field you set to null is cleared.
The three entitlements fields are replaced together. If you send any of them, the rule's
entitlements are replaced by the one you set. If every one you send is null, the rule
covers only a request for the app itself. If you send none of them, the rule's
entitlements stay as they are.
Justification shown to requesters and reviewers for why this rule exists. Leave it out to keep the current value. It cannot be null.
500Who this rule pre-approves, and for how long they can have access.
A condition is either a single check or several checks combined. A single check looks like {"attribute": {"label": "<name>", "value": "<path>"}, "<operator>": <value>} and uses exactly one operator. To require every check to match, wrap them in {"and": [...]}. To require at least one to match, wrap them in {"or": [...]}. To match the opposite of a check, wrap it in {"not": {...}}.
Only the attributes below are accepted, and each one accepts only the operators listed for it. Any other attribute or operator returns 400.
identity.groups[*].external_idacceptscontains_any. The value is a list of{"label": "<group name>", "value": "<group ID>"}, where the group ID is the ID the group has in the app it comes from. The check matches a person who belongs to any of the listed groups.identity.email,identity.team,identity.title, andidentity.statusacceptequals,!=,in,exists,contains,starts_with, andends_with.identity.start_dateandidentity.end_dateacceptequals,!=,>,>=,<,<=,in, andexists.identity.source_app.idacceptsequals,!=,in, andexists.identity.custom_attributes["<Key>"]checks a custom attribute your organization has defined. For an attribute whose value is a person, useidentity.custom_attributes["<Key>"].id. For an attribute whose value is a group, useidentity.custom_attributes["<Key>"].external_id. It accepts the same operators as the attributes above that have the same value type. To match any of several values, useinwith a list of{"label": "<display name>", "value": "<value>"}.webhook.responses["<webhook ID>"]checks the response of one of your organization's pre-approval webhooks, which is called when the request is evaluated. It accepts onlyequalswith the value"PREAPPROVED", and can't be inside anot. The check matches when the webhook pre-approves the request.identity.oncall["<schedule ID>"].on_callchecks whether the person is on call for an on-call schedule when the request is evaluated. The schedule ID is the schedule's entitlement ID. It accepts onlyequalswith the valuetrue, and can't be inside anot.access_request.access_lengthacceptsequals,!=,>,>=,<,<=, andin. Values are in seconds, for example{"label": "<display name>", "value": <seconds>}. To match unlimited access, use the value2147483647(2**31 - 1). Leaving this attribute out allows any duration, unlimited included.
Leave it out to keep the current value. It cannot be null, because every rule must limit who it applies to.
IDs of the entitlements this rule covers. The rule does not cover a request for any other entitlement. Exactly one of request_includes_entitlements, request_does_not_include_entitlements, and request_has_entitlements decides which requested entitlements this rule pre-approves. Responses include only that field. In requests, leave the other two out or set them to null. When a request asks for several entitlements, the rule checks each one separately.
1IDs of the entitlements this rule does not cover. The rule covers every other entitlement, and also a request for the app itself with no entitlement attached. Exactly one of request_includes_entitlements, request_does_not_include_entitlements, and request_has_entitlements decides which requested entitlements this rule pre-approves. Responses include only that field. In requests, leave the other two out or set them to null. When a request asks for several entitlements, the rule checks each one separately.
1true covers a request for any entitlement of this app, so you don't need to keep a list of IDs up to date. false covers only a request for the app itself with no entitlement attached. Exactly one of request_includes_entitlements, request_does_not_include_entitlements, and request_has_entitlements decides which requested entitlements this rule pre-approves. Responses include only that field. In requests, leave the other two out or set them to null. When a request asks for several entitlements, the rule checks each one separately.
Response
Successful Response
A rule that pre-approves matching access requests for an app.
UUID of this pre-approval rule.
UUID of the app this pre-approval rule applies to.
Justification shown to requesters and reviewers for why this rule exists.
Who this rule pre-approves, and for how long they can have access.
A condition is either a single check or several checks combined. A single check looks like {"attribute": {"label": "<name>", "value": "<path>"}, "<operator>": <value>} and uses exactly one operator. To require every check to match, wrap them in {"and": [...]}. To require at least one to match, wrap them in {"or": [...]}. To match the opposite of a check, wrap it in {"not": {...}}.
Only the attributes below are accepted, and each one accepts only the operators listed for it. Any other attribute or operator returns 400.
identity.groups[*].external_idacceptscontains_any. The value is a list of{"label": "<group name>", "value": "<group ID>"}, where the group ID is the ID the group has in the app it comes from. The check matches a person who belongs to any of the listed groups.identity.email,identity.team,identity.title, andidentity.statusacceptequals,!=,in,exists,contains,starts_with, andends_with.identity.start_dateandidentity.end_dateacceptequals,!=,>,>=,<,<=,in, andexists.identity.source_app.idacceptsequals,!=,in, andexists.identity.custom_attributes["<Key>"]checks a custom attribute your organization has defined. For an attribute whose value is a person, useidentity.custom_attributes["<Key>"].id. For an attribute whose value is a group, useidentity.custom_attributes["<Key>"].external_id. It accepts the same operators as the attributes above that have the same value type. To match any of several values, useinwith a list of{"label": "<display name>", "value": "<value>"}.webhook.responses["<webhook ID>"]checks the response of one of your organization's pre-approval webhooks, which is called when the request is evaluated. It accepts onlyequalswith the value"PREAPPROVED", and can't be inside anot. The check matches when the webhook pre-approves the request.identity.oncall["<schedule ID>"].on_callchecks whether the person is on call for an on-call schedule when the request is evaluated. The schedule ID is the schedule's entitlement ID. It accepts onlyequalswith the valuetrue, and can't be inside anot.access_request.access_lengthacceptsequals,!=,>,>=,<,<=, andin. Values are in seconds, for example{"label": "<display name>", "value": <seconds>}. To match unlimited access, use the value2147483647(2**31 - 1). Leaving this attribute out allows any duration, unlimited included.
null when the rule is limited by a webhook, an on-call schedule, or an access policy instead. This API can't show those limits.
IDs of the entitlements this rule covers. The rule does not cover a request for any other entitlement. Exactly one of request_includes_entitlements, request_does_not_include_entitlements, and request_has_entitlements decides which requested entitlements this rule pre-approves. Responses include only that field. In requests, leave the other two out or set them to null. When a request asks for several entitlements, the rule checks each one separately.
1IDs of the entitlements this rule does not cover. The rule covers every other entitlement, and also a request for the app itself with no entitlement attached. Exactly one of request_includes_entitlements, request_does_not_include_entitlements, and request_has_entitlements decides which requested entitlements this rule pre-approves. Responses include only that field. In requests, leave the other two out or set them to null. When a request asks for several entitlements, the rule checks each one separately.
1true covers a request for any entitlement of this app, so you don't need to keep a list of IDs up to date. false covers only a request for the app itself with no entitlement attached. Exactly one of request_includes_entitlements, request_does_not_include_entitlements, and request_has_entitlements decides which requested entitlements this rule pre-approves. Responses include only that field. In requests, leave the other two out or set them to null. When a request asks for several entitlements, the rule checks each one separately.