Create an Entitlement That Provisions Through a Group

import os
import time

import requests

BASE_URL = "https://api.lumos.com"
APP_ID = "<APP_ID>"  # The app to add the entitlement to. It must be in the AppStore.
GROUP_ID = "<GROUP_ID>"  # The Lumos ID of the group to add each person to.
LABEL = "Deployer"  # The name requesters see in the AppStore.

session = requests.Session()
session.headers["Authorization"] = f"Bearer {os.environ['LUMOS_API_TOKEN']}"


def call(method, path, **kwargs):
    """Call a v1 endpoint, waiting out rate limits."""
    while True:
        response = session.request(method, f"{BASE_URL}{path}", **kwargs)
        if response.status_code == 429:
            time.sleep(float(response.headers.get("Retry-After", 1)))
            continue
        response.raise_for_status()
        return response.json() if response.content else None


# Check that the app offers the add_to_group step for entitlement provisioning.
params = {"app_id": APP_ID, "type": "entitlement-provisioning"}
steps = set()
while True:
    page = call("GET", "/v1/workflow-steps", params=params)
    steps.update(step["step"] for step in page["workflow_steps"])
    if not page.get("next_page_token"):
        break
    params["page_token"] = page["next_page_token"]
if "add_to_group" not in steps:
    raise SystemExit("This app doesn't offer the add_to_group step.")

# Create the entitlement, then hide it until its workflow is bound.
entitlement = call("POST", "/v1/entitlements", json={"app_id": APP_ID, "label": LABEL})
settings_path = f"/v1/entitlements/{entitlement['id']}/appstore-settings"
call("PATCH", settings_path, json={"visible_in_appstore": False})

# Create the provisioning workflow, and bind it to the entitlement.
workflow = call(
    "POST",
    "/v1/workflows",
    json={
        "name": f"Add to group for {LABEL}",
        "type": "entitlement-provisioning",
        "app_id": APP_ID,
        "steps": [{"step": "add_to_group", "inputs": {"group_id": GROUP_ID}}],
    },
)
call(
    "PUT",
    f"/v1/entitlements/{entitlement['id']}/provisioning-workflow",
    json={"workflow_id": workflow["id"]},
)

# Show the entitlement in the AppStore.
call("PATCH", settings_path, json={"visible_in_appstore": True})
print(f"entitlement: {entitlement['id']}")
print(f"workflow: {workflow['id']}")