Create new permissions with a provisioning group

import requests

APP_ID = "<APP_ID>"
GROUP_ID = "<GROUP_ID>"

API_TOKEN = "<YOUR_API_TOKEN>"

url = "https://api.lumos.com/appstore/requestable_permissions"

headers = {
    "accept": "application/json",
    "authorization": "Bearer <YOUR_API_TOKEN>",
}

payload_with_lumos_group_id = {
    "request_config": {
        "appstore_visibility": "VISIBLE",
        "allowed_groups": {"type": "ALL_GROUPS"},
        "request_fulfillment_config": {"provisioning_group": {"id": GROUP_ID}},
    },
    "app_id": APP_ID,
    "label": "New Permission!",
}

response = requests.post(url, json=payload_with_lumos_group_id, headers=headers)
print(response.json())

GROUP_INTEGRATION_SPECIFIC_ID = "<GROUP_INTEGRATION_SPECIFIC_ID>"
GROUP_APP_ID = "<GROUP_APP_ID>"

payload_with_external_group_id = {
    "request_config": {
        "appstore_visibility": "VISIBLE",
        "allowed_groups": {"type": "ALL_GROUPS"},
        "request_fulfillment_config": {
            "provisioning_group": {
                "app_id": GROUP_APP_ID,
                "integration_specific_id": GROUP_INTEGRATION_SPECIFIC_ID,
            }
        },
    },
    "app_id": APP_ID,
    "label": "New Permission",
}
response = requests.post(url, json=payload_with_external_group_id, headers=headers)
print(response.json())

import requests

APP_ID = "<APP_ID>"
GROUP_ID = "<GROUP_ID>"

API_TOKEN = "<YOUR_API_TOKEN>"

url = "https://api.lumos.com/appstore/requestable_permissions"

headers = {
    "accept": "application/json",
    "authorization": "Bearer <YOUR_API_TOKEN>",
}

payload_with_lumos_group_id = {
    "request_config": {
        "appstore_visibility": "VISIBLE",
        "allowed_groups": {"type": "ALL_GROUPS"},
        "request_fulfillment_config": {"provisioning_group": {"id": GROUP_ID}},
    },
    "app_id": APP_ID,
    "label": "New Permission!",
}

response = requests.post(url, json=payload_with_lumos_group_id, headers=headers)
print(response.json())

GROUP_INTEGRATION_SPECIFIC_ID = "<GROUP_INTEGRATION_SPECIFIC_ID>"
GROUP_APP_ID = "<GROUP_APP_ID>"

payload_with_external_group_id = {
    "request_config": {
        "appstore_visibility": "VISIBLE",
        "allowed_groups": {"type": "ALL_GROUPS"},
        "request_fulfillment_config": {
            "provisioning_group": {
                "app_id": GROUP_APP_ID,
                "integration_specific_id": GROUP_INTEGRATION_SPECIFIC_ID,
            }
        },
    },
    "app_id": APP_ID,
    "label": "New Permission",
}
response = requests.post(url, json=payload_with_external_group_id, headers=headers)
print(response.json())

import requests

APP_ID = "<APP_ID>"
GROUP_ID = "<GROUP_ID>"

API_TOKEN = "<YOUR_API_TOKEN>"

url = "https://api.lumos.com/appstore/requestable_permissions"

headers = {
    "accept": "application/json",
    "authorization": "Bearer <YOUR_API_TOKEN>",
}

payload_with_lumos_group_id = {
    "request_config": {
        "appstore_visibility": "VISIBLE",
        "allowed_groups": {"type": "ALL_GROUPS"},
        "request_fulfillment_config": {"provisioning_group": {"id": GROUP_ID}},
    },
    "app_id": APP_ID,
    "label": "New Permission!",
}

response = requests.post(url, json=payload_with_lumos_group_id, headers=headers)
print(response.json())

GROUP_INTEGRATION_SPECIFIC_ID = "<GROUP_INTEGRATION_SPECIFIC_ID>"
GROUP_APP_ID = "<GROUP_APP_ID>"

payload_with_external_group_id = {
    "request_config": {
        "appstore_visibility": "VISIBLE",
        "allowed_groups": {"type": "ALL_GROUPS"},
        "request_fulfillment_config": {
            "provisioning_group": {
                "app_id": GROUP_APP_ID,
                "integration_specific_id": GROUP_INTEGRATION_SPECIFIC_ID,
            }
        },
    },
    "app_id": APP_ID,
    "label": "New Permission",
}
response = requests.post(url, json=payload_with_external_group_id, headers=headers)
print(response.json())

Find the app id

First, you’ll need the Lumos ID for the app you’re looking to add your permissions to. You can find it by using the API itself, or by inspecting the URL of your app of choice in the All Apps page: https://app.lumosidentity.com/apps?tab=apps.Replace <APP_ID> with the app ID.

Find the group id

[Note] This step is optional. To keep provisioning for your AppStore permissions manual, skip this step. You can alternatively associate an inline webhook to the permission to build your own provisioning flow.Next, you’ll need to find the Lumos id of the provisioning group you’d like to set as the provisioning group for this permission.Once this provisioning group is set on the permission, Lumos will automatically provision to and deprovision from the group in Okta.You can use the groups API endpoints to find the right group.Lumos syncs groups from third party services. You can also use the third-party identifier on the group for this API routine. A later step covers this.

Setup your API token and URL

This recipe uses this endpoint to create permissions. Replace <YOUR_API_TOKEN> with an API token from https://app.lumosidentity.com/settings/api_tokens.

Build the first payload

Set the AppStore visibility to “VISIBLE” so the permission appears in the AppStore.
Pass in “ALL_GROUPS” so everyone can see this permission.
Set the provisioning group you found earlier as the “provisioning_group” on the “request_fulfillment_config”.
Pass in the APP_ID of the app to create the permission on, and a label that end users see: “New Permission!”

This payload doesn’t set an approver on the permission, so the application-level approver also approves access to this permission. To customize approvals later, use the request_approval_config field on the payload.

Create the permission

This will create the permission and return a JSON with its metadata. You should now be able to see it in the Lumos AppStore UI as well.

Find alternative identifiers for a group

Sometimes you might already have the external identifier of the Group handy, for example from Google Workspace or Okta.You can use the external group id from these tools here as well by filling out the GROUP_INTEGRATION_SPECIFIC_ID. You’ll also need to find the GROUP_APP_ID, which is the Lumos id of the app that sourced this group. It should be the app of your Google Workspace or Okta integration in Lumos.Keep in mind it’s possible the external group may not have been brought over to Lumos via an automated sync yet. New groups in third party services come into Lumos daily.

Create the permission

This will create the permission and return a JSON with its metadata. You should now be able to see it in the Lumos AppStore UI as well.

Quickstart

Lumos Connectors

Lumos

Guides

Webhooks

Examples

Tools

Recipes

Create new permissions with a provisioning group