> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # Create Access Request > Create a request to access a specific permission in the appstore. ## OpenAPI ````yaml openapi/lumos.json POST /appstore/access_request openapi: 3.1.0 info: title: Lumos description: |2 The Lumos API gives you the building blocks to administer and extend Lumos programmatically. Our REST API provides a management interface for the AppStore and a read interface for the Lumos Core. Go to https://developers.lumos.com to see our complete documentation. version: 0.1.0 servers: - url: https://api.lumos.com security: [] tags: - name: Access Reviews description: > Create and manage access review campaigns — scheduled reviews of who has access to what across your connected apps. **Typical workflow for creating a review:** 1. `GET /apps` — find the domain app UUIDs you want to review. 2. `GET /access_reviews/scope_options?domain_app_id={id}` — discover available scope filters (employment status, team, last login, etc.). Each returned `items` entry is a ready-to-POST `scope_filters` payload; datetime and custom-attribute groups instead expose a `filter_input_template`. 3. `POST /access_reviews` with `apps` (optionally with `scope_filters` per app) — creates the campaign. 4. `GET /access_reviews/{id}` — poll until `status` transitions from `IN_PREPARATION` to `IN_PROGRESS`. **After creation:** - `POST /access_reviews/{id}/apps` — add more apps while `status != COMPLETED`. - `PATCH /access_reviews/{id}` — update name / deadline / owner, or per-ARDA `scope_filters` and removal action. - `DELETE /access_reviews/{id}` — soft-delete the whole campaign. - `DELETE /access_reviews/{id}/apps/{arda_id}` — soft-delete a single app from the campaign. All endpoints require an API token with the `access_reviews.create` or `access_reviews.view` permission (Access Review Administrator or App Admin role). - name: Tasks description: > **Tasks** are work items emitted by Lumos workflows — things that need a human (or an automated caller) to make a decision or perform a step before the workflow can proceed. Typical examples: - An access request is waiting on an approver's decision. - A provisioning or deprovisioning step needs manual fulfillment. - An error needs acknowledgement. Each task carries two classification fields you can filter on: - **`task_category`** — what kind of decision or step the task represents. Values: `APPROVAL`, `PROVISIONING`, `DEPROVISIONING`, `ERROR`. - **`product_area`** — which Lumos product surface emitted the task. Values: `APPSTORE`, `ACCESS_REVIEWS`, `MOVER`, `ATTRIBUTE_SYNC`, `OFFBOARDING`, `ONBOARDING`, `PLATFORM`, `SAVINGS`. ### Which endpoint should I call? - **To approve or deny an access request**, use `POST /tasks/{task_id}/complete` (approve) or `POST /tasks/{task_id}/dismiss` (deny). - **To find pending approval tasks**, call `GET /tasks?task_category=APPROVAL&product_area=APPSTORE&status=PENDING` (access requests). - **Only use `POST /tasks/{task_id}/perform-action`** for tasks that expose custom workflow actions. Discover those actions via `GET /tasks/{task_id}/actions`. Approval tasks do not require this endpoint — `complete` and `dismiss` are the right primitives. For a full walkthrough with `curl` and Python examples, see the [Tasks API How-To](https://developers.lumos.com/docs/tasks-api-how-to) guide. - name: Integrations description: > An integration is a service Lumos knows how to connect to, identified by an `app_class_id` such as `okta.com` or `workspace.google.com`. This is the catalog you connect *from*. Apps you have already connected are read through the Apps endpoints. Only connectable integrations appear here. Software discovered in your environment that has no Lumos integration behind it is excluded. ### Discovering how to connect 1. `GET /v1/integrations?query=google` to find the integration. The filter matches both the `app_class_id` and the display name, so `google` returns `workspace.google.com` and `cloud.google.com`. 2. `GET /v1/integrations/{app_class_id}/connection-schema` for the JSON schema of the `auth` and `settings` fields it expects. 3. `POST /v1/apps` with those values. Step 2 is the point of this group: it lets you build a connect form, or generate a Terraform resource, without hardcoding one credential shape per integration. Integrations whose connection schema Lumos cannot describe yet return 404. - name: Apps description: > An app is an integration you have connected, one per connected instance of a service. Your Okta tenant is an app. A second Slack workspace is a second app. ### Connecting one 1. `GET /v1/integrations/{app_class_id}/connection-schema` to see which `auth` and `settings` keys the integration expects. 2. `POST /v1/apps` with those credentials. Apps whose credentials validate right away connect and start an initial sync. Apps that need browser consent are finished in the Lumos UI. 3. `GET /v1/apps/{app_uuid}` to follow `sync_status`. 4. `POST /v1/apps/{app_uuid}/sync` to resync later. Only one sync runs per app at a time, so a second request while one is in flight returns 409. Rotate credentials with `PUT /v1/apps/{app_uuid}`. `DELETE /v1/apps/{app_uuid}` drops the stored credentials and returns the app to a connectable state. ### Reading apps `expand` is opt-in and evaluated per field: ask for `admins`, `custom_attributes`, `appstore_settings`, or any of the three workflow slots. A field you lack permission to read is left out of the response instead of failing the whole request, so a 200 does not prove every field you asked for came back. To reconcile the apps you manage from automation such as Terraform, combine `connection_source=API` with `disconnected=false`. ### Workflow slots Each app carries three bindings: an approval workflow, a default provisioning workflow, and a default deprovisioning workflow. The two `default_` slots supply the workflow that entitlements on the app fall back to. To bind a workflow to one entitlement instead, use the Entitlements endpoints. - name: Entitlements description: > An entitlement is a grantable unit of access on an app: a role, a license tier, a group, a permission. Accounts hold entitlements. - `POST /v1/entitlements` creates a requestable entitlement on an app. - `GET /v1/apps/{app_uuid}/entitlements` lists the entitlements on one app. - `GET /v1/entitlements/{entitlement_uuid}/accounts` lists who currently holds one. - `PATCH /v1/entitlements/{entitlement_uuid}` renames it. `label` is the only field you can change today, and sending any other field returns 400. - `DELETE /v1/entitlements/{entitlement_uuid}` refuses while the entitlement is still held, returning 409 with an `active_accounts` count. ### Per-entitlement workflows Three slots bind a workflow to a single entitlement rather than to the whole app: an approval override, a provisioning workflow, and a deprovisioning workflow. Each has a GET and a PUT. Not every entitlement supports them. An entitlement with no request configuration behind it returns 404 with `Workflows are not available for this entitlement.` on all six. - name: Accounts description: > An account is a person's presence inside a connected app. Accounts arrive through sync; you cannot create one through this API. `GET /v1/accounts/{account_uuid}/entitlements` lists what one account holds. It reads the same relationship as `GET /v1/entitlements/{entitlement_uuid}/accounts`, from the account's side rather than the entitlement's. - name: Workflows description: > A workflow is a reusable definition of the steps Lumos runs to approve a request, provision access, or deprovision it. Create the definition here, then bind it to an app or an entitlement through their own workflow endpoints. ### Building one 1. `GET /v1/workflow-steps?app_id={app_uuid}` to discover the steps available for that app, each with the input schema it accepts. 2. `POST /v1/workflows` with the steps you want. 3. Bind it, for example with `PUT /v1/apps/{app_uuid}/default-provisioning-workflow`. `type` and `app_id` are fixed at creation. `PUT /v1/workflows/{workflow_id}` rejects changes to either. ### Workflows this API cannot describe Some workflows Lumos builds for you, including the out-of-the-box provisioning defaults, contain steps with no public representation. `GET /v1/workflows` skips them, so a page can hold fewer items than `page_size` while more results remain. Treat an absent `next_page_token`, not a short page, as the end of the list. Binding one of these to a slot returns 400. - name: Custom Attribute Definitions description: > Custom attributes are the extra fields your organization keeps on users and accounts. These endpoints read their *definitions*, not the values stored against any particular user. `GET /v1/custom-attribute-definitions` returns one entry per label, unified across every app that supplies it. Narrow the list with `config_type` to separate user attributes from account attributes, with `source_type` to tell attributes synced from an app apart from ones your team created, or with `app_id` to see only what a single app supplies. - name: Knowledge description: > Knowledge entries are the documents and notes Lumos agents draw on when they answer access questions. Each entry carries a title, body, tags, and product scopes, plus an optional file attachment. Because of that attachment, create and update send `multipart/form-data` rather than JSON. On update, tag and scope lists replace what was there instead of appending, and `clear_attachment=true` removes an existing file without uploading a replacement. `DELETE` archives rather than destroys. The entry stops appearing in list results and stays recoverable. Pages here are small: `page_size` defaults to 10 and is clamped to 25. paths: /appstore/access_request: post: tags: - AppStore summary: Create Access Request description: Create a request to access a specific permission in the appstore. operationId: createAccessRequest requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateAccessRequestInput' required: true responses: '201': description: Successful Response content: application/json: schema: items: $ref: '#/components/schemas/AccessRequest' type: array title: Response Createaccessrequest '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] components: schemas: CreateAccessRequestInput: properties: app_id: type: string title: App Id requester_user_id: type: string title: Requester User Id description: >- Override the user who made the request. If omitted, use the current user. Only available to organization admins. target_user_id: type: string title: Target User Id description: >- User to request access for. If omitted, request for the current user. note: anyOf: - type: string - type: 'null' title: Note description: '[Deprecated - use business_justification] Why the user needs access.' business_justification: anyOf: - type: string - type: 'null' title: Business Justification description: Why the user needs access. expiration_in_seconds: anyOf: - type: integer - type: 'null' title: Expiration In Seconds description: >- Once granted, how long the access should last. Omit for permanent access. access_length: anyOf: - type: string - type: 'null' title: Access Length description: >- Once granted, how long the access should last. Omit for permanent access. All possible values are '2 hours', '4 hours', '8 hours', '12 hours', '1 day', '2 days', '3 days', '7 days', '14 days', '30 days', '90 days', 'Unlimited', but the exact options depend on the settings of the app and permissions. requestable_permission_ids: anyOf: - items: type: string type: array - type: 'null' title: Requestable Permission Ids description: >- The IDs of the requestable permissions the user is requesting access to. Omit this to just request access to the app. type: object required: - app_id title: CreateAccessRequestInput AccessRequest: properties: id: type: string title: Id description: The ID of the access request. app_id: type: string title: App Id description: The ID of the app the request is for. app_name: type: string title: App Name description: The name of the app the request is for. requester_user: anyOf: - $ref: '#/components/schemas/User' - type: 'null' description: >- The user who requested access. It's possible for one user to request access on another's behalf. None for system-initiated requests, such as automated onboarding policies, that have no human requester. target_user: $ref: '#/components/schemas/User' description: The user the request is for. supporter_user: anyOf: - $ref: '#/components/schemas/User' - type: 'null' description: >- The user supporting this request, if any. None if no supporter has been assigned. status: $ref: '#/components/schemas/SupportRequestStatus' description: The current status of the request. notes: additionalProperties: anyOf: - type: string - type: 'null' type: object title: Notes description: >- The reason the user wrote for putting the access request into the given state. default: {} expires_at: anyOf: - type: string format: date-time - type: 'null' title: Expires At expiration_in_seconds: anyOf: - type: integer - type: 'null' title: Expiration In Seconds description: >- For time-based access requests, the number of seconds after provisioning at which access should be removed. None for permanent requests. requestable_permissions: anyOf: - items: $ref: '#/components/schemas/RequestablePermissionOutput' type: array - type: 'null' title: Requestable Permissions requested_at: anyOf: - type: string format: date-time - type: 'null' title: Requested At tasks: anyOf: - items: $ref: '#/components/schemas/Task' type: array - type: 'null' title: Tasks custom_fields: anyOf: - items: $ref: '#/components/schemas/CustomIntakeFieldResponseOutput' type: array - type: 'null' title: Custom Fields type: object required: - id - app_id - app_name - target_user - status title: AccessRequest description: API version of DomainAppSupportRequest. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError User: properties: id: type: string title: Id description: The ID of this user. email: anyOf: - type: string - type: 'null' title: Email description: The email of this user. given_name: anyOf: - type: string - type: 'null' title: Given Name description: The given name of this user. family_name: anyOf: - type: string - type: 'null' title: Family Name description: The family name of this user. status: anyOf: - $ref: '#/components/schemas/UserLifecycleStatus' - type: 'null' description: The status of this user. type: object required: - id title: User SupportRequestStatus: type: string enum: - PENDING - PENDING_MANAGER_APPROVAL - MANAGER_APPROVED - MANAGER_DENIED - PENDING_APPROVAL - APPROVED - DENIED - EXPIRED - CANCELLED - PENDING_PROVISIONING - PENDING_MANUAL_PROVISIONING - DENIED_PROVISIONING - PROVISIONED - PENDING_DEPROVISIONING - PENDING_MANUAL_DEPROVISIONING - TIME_BASED_EXPIRED - COMPLETED - REVERTING - REVERTED - TIME_BASED_EXPIRED_FAILED - TIME_BASED_EXPIRED_CANCELLED title: SupportRequestStatus RequestablePermissionOutput: properties: id: type: string title: Id description: The ID of this requestable permission. type: anyOf: - $ref: '#/components/schemas/PermissionType' - type: 'null' description: The type of this requestable permission. label: type: string title: Label description: The label of this requestable permission. app_id: type: string title: App Id description: The ID of the app associated with this requestable permission. app_class_id: type: string title: App Class Id description: >- The non-unique ID of the service associated with this requestable permission. Depending on how it is sourced in Lumos, this may be the app's name, website, or other identifier. app_instance_id: type: string title: App Instance Id description: >- The ID of the instance associated with this requestable permission. This may be an empty string. request_config: $ref: '#/components/schemas/RequestConfigOutput' description: The request config associated with this requestable permission. type: object required: - label - app_id - app_class_id - app_instance_id title: RequestablePermissionOutput Task: properties: id: type: string title: Id description: The ID of this task. task_type: type: string title: Task Type description: The type of this task. task_category: $ref: '#/components/schemas/TaskCategory' description: The category of this task. status: $ref: '#/components/schemas/TaskStatus' description: The current status of this task. description: anyOf: - type: string - type: 'null' title: Description description: A description of this task. instructions: anyOf: - type: string - type: 'null' title: Instructions description: Instructions for completing this task. product_area: anyOf: - $ref: '#/components/schemas/TaskProductArea' - type: 'null' description: The product area this task is related to. app: anyOf: - $ref: '#/components/schemas/BaseApp' - type: 'null' description: The app this task is related to. target_user: anyOf: - $ref: '#/components/schemas/User' - type: 'null' description: The user this task is about. resolved_by: anyOf: - $ref: '#/components/schemas/User' - type: 'null' description: The user who resolved this task. created_at: type: string format: date-time title: Created At description: When this task was created. updated_at: type: string format: date-time title: Updated At description: When this task was last updated. assignees: anyOf: - items: $ref: '#/components/schemas/TaskAssignee' type: array - type: 'null' title: Assignees description: The assignees of this task. Requires expand=assignees. actions: anyOf: - items: $ref: '#/components/schemas/TaskAction' type: array - type: 'null' title: Actions description: Available actions for this task. Requires expand=actions. comments: anyOf: - items: $ref: '#/components/schemas/TaskComment' type: array - type: 'null' title: Comments description: Comments on this task. Requires expand=comments. access_request_id: anyOf: - type: string - type: 'null' title: Access Request Id description: The access request this task is associated with, if applicable. requestable_permission_id: anyOf: - type: string - type: 'null' title: Requestable Permission Id description: >- The requestable permission this task is associated with, if applicable. type: object required: - id - task_type - task_category - status - created_at - updated_at title: Task CustomIntakeFieldResponseOutput: properties: prompt: type: string title: Prompt description: The custom intake field prompt shown to the requester. response: anyOf: - type: string - type: 'null' title: Response description: The requester's response to the custom intake field. type: object required: - prompt title: CustomIntakeFieldResponseOutput description: API version of a CustomIntakeFieldResponse on an access request. ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError UserLifecycleStatus: type: string enum: - STAGED - ACTIVE - SUSPENDED - INACTIVE title: UserLifecycleStatus PermissionType: type: string enum: - SYNCED - NATIVE title: PermissionType RequestConfigOutput: properties: appstore_visibility: anyOf: - $ref: '#/components/schemas/AppStoreVisibilityOption' - type: 'null' description: The appstore visibility of this request config. default: HIDDEN allowed_groups_override: anyOf: - type: boolean - type: 'null' title: Allowed Groups Override description: >- Indicates if allowed groups is overriden from the app-level settings. allowed_groups: anyOf: - $ref: '#/components/schemas/AllowedGroupsConfigOutput' - type: 'null' description: The allowed groups config associated with this config. default: type: ALL_GROUPS groups: [] request_approval_config: anyOf: - $ref: '#/components/schemas/RequestApprovalConfigOutput' - type: 'null' description: >- A request approval config can be optionally associated with this config default: manager_approval: NONE request_approval_stages: - {} request_fulfillment_config: anyOf: - $ref: '#/components/schemas/RequestFulfillmentConfigOutput' - type: 'null' description: >- A request fulfillment config can be optionally associated with this config default: {} access_removal_inline_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: >- A deprovisioning webhook can be optionally associated with this config. request_validation_inline_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: >- A request validation webhook can be optionally associated with this config. type: object title: RequestConfigOutput TaskCategory: type: string enum: - MANAGER_APPROVAL - APPROVAL - PROVISIONING - DEPROVISIONING - ERROR - GENERIC title: TaskCategory TaskStatus: type: string enum: - PENDING - ACCEPTED - COMPLETED - DISMISSED - BLOCKED - STAGED - RETRIED - EXPIRED title: TaskStatus TaskProductArea: type: string enum: - ACCESS_REVIEWS - APPSTORE - MOVER - ATTRIBUTE_SYNC - OFFBOARDING - ONBOARDING - PLATFORM - SAVINGS title: TaskProductArea BaseApp: properties: id: type: string title: Id description: The ID of this app. type: object required: - id title: BaseApp TaskAssignee: properties: id: type: string title: Id description: The ID of the assignee. type: $ref: '#/components/schemas/TaskAssigneeType' description: Whether this assignee is a user or group. name: anyOf: - type: string - type: 'null' title: Name description: The display name of the assignee. email: anyOf: - type: string - type: 'null' title: Email description: The email of the assignee. Only set for users. type: object required: - id - type title: TaskAssignee TaskAction: properties: action_type: type: string title: Action Type description: The external identifier for this action type. transitions: items: $ref: '#/components/schemas/TaskActionTransition' type: array title: Transitions description: The possible status transitions for this action. type: object required: - action_type - transitions title: TaskAction TaskComment: properties: body: type: string title: Body description: The text content of the comment. created_by: anyOf: - $ref: '#/components/schemas/User' - type: 'null' description: The user who created the comment. created_at: type: string format: date-time title: Created At description: When the comment was created. type: object required: - body - created_at title: TaskComment AppStoreVisibilityOption: type: string enum: - HIDDEN - VISIBLE title: AppStoreVisibilityOption AllowedGroupsConfigOutput: properties: type: $ref: '#/components/schemas/AllowedGroupsConfigType' description: >- The type of this allowed groups config, can be all groups or specific. default: ALL_GROUPS groups: items: $ref: '#/components/schemas/Group' type: array title: Groups description: The groups allowed to request this permission. default: [] type: object title: AllowedGroupsConfigOutput RequestApprovalConfigOutput: properties: request_approval_config_override: anyOf: - type: boolean - type: 'null' title: Request Approval Config Override description: Indicates if approval flow is overridden. manager_approval: anyOf: - $ref: '#/components/schemas/ManagerApprovalOption' - type: 'null' description: Manager approval can be configured as necessary to continue default: NONE require_additional_approval: anyOf: - type: boolean - type: 'null' title: Require Additional Approval description: >- When true, enables a second approval stage so requests require approval from both stage 1 and stage 2 approvers. When false, disables the second approval stage and merges any existing stage 2 approvers into stage 1. When omitted, the current multi-stage approval setting is left unchanged. custom_approval_message: anyOf: - type: string - type: 'null' title: Custom Approval Message description: >- After the approval step, send a custom message to requesters. Note that the permission level approval message will override the App level approval message if custom_approval_message_override is set. Markdown for links and text formatting is supported. custom_approval_message_override: anyOf: - type: boolean - type: 'null' title: Custom Approval Message Override description: Indicates if custom_approval_message is overridden. approvers: anyOf: - $ref: '#/components/schemas/AppApproversOutput' - type: 'null' description: AppStore App approvers assigned. approvers_stage_2: anyOf: - $ref: '#/components/schemas/AppApproversOutput' - type: 'null' description: AppStore App stage 2 approvers assigned. request_approval_stages: anyOf: - items: $ref: '#/components/schemas/RequestApprovalStageOutput' type: array - type: 'null' title: Request Approval Stages description: The stages of this request approval. default: - {} response_describes_entire_approval_workflow: anyOf: - type: boolean - type: 'null' title: Response Describes Entire Approval Workflow description: >- Indicates whether the approval configuration is fully represented by the existing API. If False, the approval configuration may contain additional stages or conditional approval chains not reflected in the v1 API. type: object title: RequestApprovalConfigOutput RequestFulfillmentConfigOutput: properties: manual_steps_needed: anyOf: - type: boolean - type: 'null' title: Manual Steps Needed description: Whether manual steps are needed. manual_instructions: anyOf: - type: string - type: 'null' title: Manual Instructions description: The manual instructions that go along. time_based_access: items: type: string type: array title: Time Based Access description: >- If enabled, users can request an app for a selected duration. After expiry, Lumos will automatically remove user's access. time_based_access_override: anyOf: - type: boolean - type: 'null' title: Time Based Access Override description: Indicates if time based access is overriden. provisioning_group: anyOf: - $ref: '#/components/schemas/Group' - type: 'null' description: The provisioning group optionally assocated with this config. provisioning_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: The provisioning webhook optionally associated with this config. type: object title: RequestFulfillmentConfigOutput InlineWebhook: properties: id: type: string title: Id description: The ID of this inline webhook. hook_type: $ref: '#/components/schemas/InlineWebhookType' description: The type of this inline webhook. name: type: string title: Name description: The name of this inline webhook. description: anyOf: - type: string - type: 'null' title: Description description: The description of this inline webhook. type: object required: - id - hook_type - name title: InlineWebhook TaskAssigneeType: type: string enum: - USER - GROUP title: TaskAssigneeType TaskActionTransition: properties: transition_to: anyOf: - $ref: '#/components/schemas/TaskStatus' - type: 'null' description: The status the task will transition to when this action is taken. type: object title: TaskActionTransition AllowedGroupsConfigType: type: string enum: - ALL_GROUPS - SPECIFIED_GROUPS title: AllowedGroupsConfigType Group: properties: id: anyOf: - type: string - type: 'null' title: Id description: The ID of this group. app_id: anyOf: - type: string - type: 'null' title: App Id description: The ID of the app that sources this group. integration_specific_id: anyOf: - type: string - type: 'null' title: Integration Specific Id description: The ID of this group, specific to the integration. name: anyOf: - type: string - type: 'null' title: Name description: The name of this group. description: anyOf: - type: string - type: 'null' title: Description description: The description of this group. group_lifecycle: anyOf: - $ref: '#/components/schemas/Lifecycle' - type: 'null' description: The lifecycle of this group. default: SYNCED source_app_id: anyOf: - type: string - type: 'null' title: Source App Id description: The ID of the app that sources this group. type: object title: Group ManagerApprovalOption: type: string enum: - NONE - INITIAL_APPROVAL title: ManagerApprovalOption AppApproversOutput: properties: groups: items: $ref: '#/components/schemas/Group' type: array title: Groups description: Groups assigned as support request approvers. default: [] users: items: $ref: '#/components/schemas/User' type: array title: Users description: Users assigned as support request approvers. default: [] type: object title: AppApproversOutput RequestApprovalStageOutput: properties: approvers: anyOf: - items: $ref: '#/components/schemas/ApproverOutput' type: array - type: 'null' title: Approvers description: The approvers of this stage. type: object title: RequestApprovalStageOutput InlineWebhookType: type: string enum: - PRE_APPROVAL - PROVISION - DEPROVISION - REQUEST_VALIDATION - SIEM title: InlineWebhookType Lifecycle: type: string enum: - SYNCED - NATIVE title: Lifecycle ApproverOutput: properties: type: $ref: '#/components/schemas/ApproverType' description: The type of this approver. user: anyOf: - $ref: '#/components/schemas/User' - type: 'null' description: Optionally, the approver can be a user. group: anyOf: - $ref: '#/components/schemas/Group' - type: 'null' description: Optionally, the approver can be a group. type: object required: - type title: ApproverOutput ApproverType: type: string enum: - USER - GROUP title: ApproverType securitySchemes: HTTPBearer: type: http scheme: bearer ````