> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # Update Domain App Appstore Settings > Update app settings. ## OpenAPI ````yaml openapi/lumos.json PATCH /apps/{app_id}/settings openapi: 3.1.0 info: title: Lumos description: |2 The Lumos API gives you the building blocks to administer and extend Lumos programmatically. Our REST API provides a management interface for the AppStore and a read interface for the Lumos Core. Go to https://developers.lumos.com to see our complete documentation. version: 0.1.0 servers: - url: https://api.lumos.com security: [] tags: - name: Access Reviews description: > Create and manage access review campaigns — scheduled reviews of who has access to what across your connected apps. **Typical workflow for creating a review:** 1. `GET /apps` — find the domain app UUIDs you want to review. 2. `GET /access_reviews/scope_options?domain_app_id={id}` — discover available scope filters (employment status, team, last login, etc.). Each returned `items` entry is a ready-to-POST `scope_filters` payload; datetime and custom-attribute groups instead expose a `filter_input_template`. 3. `POST /access_reviews` with `apps` (optionally with `scope_filters` per app) — creates the campaign. 4. `GET /access_reviews/{id}` — poll until `status` transitions from `IN_PREPARATION` to `IN_PROGRESS`. **After creation:** - `POST /access_reviews/{id}/apps` — add more apps while `status != COMPLETED`. - `PATCH /access_reviews/{id}` — update name / deadline / owner, or per-ARDA `scope_filters` and removal action. - `DELETE /access_reviews/{id}` — soft-delete the whole campaign. - `DELETE /access_reviews/{id}/apps/{arda_id}` — soft-delete a single app from the campaign. All endpoints require an API token with the `access_reviews.create` or `access_reviews.view` permission (Access Review Administrator or App Admin role). - name: Tasks description: > **Tasks** are work items emitted by Lumos workflows — things that need a human (or an automated caller) to make a decision or perform a step before the workflow can proceed. Typical examples: - An access request is waiting on an approver's decision. - A provisioning or deprovisioning step needs manual fulfillment. - An error needs acknowledgement. Each task carries two classification fields you can filter on: - **`task_category`** — what kind of decision or step the task represents. Values: `APPROVAL`, `PROVISIONING`, `DEPROVISIONING`, `ERROR`. - **`product_area`** — which Lumos product surface emitted the task. Values: `APPSTORE`, `ACCESS_REVIEWS`, `MOVER`, `ATTRIBUTE_SYNC`, `OFFBOARDING`, `ONBOARDING`, `PLATFORM`, `SAVINGS`. ### Which endpoint should I call? - **To approve or deny an access request**, use `POST /tasks/{task_id}/complete` (approve) or `POST /tasks/{task_id}/dismiss` (deny). - **To find pending approval tasks**, call `GET /tasks?task_category=APPROVAL&product_area=APPSTORE&status=PENDING` (access requests). - **Only use `POST /tasks/{task_id}/perform-action`** for tasks that expose custom workflow actions. Discover those actions via `GET /tasks/{task_id}/actions`. Approval tasks do not require this endpoint — `complete` and `dismiss` are the right primitives. For a full walkthrough with `curl` and Python examples, see the [Tasks API How-To](https://developers.lumos.com/docs/tasks-api-how-to) guide. - name: Integrations description: > An integration is a service Lumos knows how to connect to, identified by an `app_class_id` such as `okta.com` or `workspace.google.com`. This is the catalog you connect *from*. Apps you have already connected are read through the Apps endpoints. Only connectable integrations appear here. Software discovered in your environment that has no Lumos integration behind it is excluded. ### Discovering how to connect 1. `GET /v1/integrations?query=google` to find the integration. The filter matches both the `app_class_id` and the display name, so `google` returns `workspace.google.com` and `cloud.google.com`. 2. `GET /v1/integrations/{app_class_id}/connection-schema` for the JSON schema of the `auth` and `settings` fields it expects. 3. `POST /v1/apps` with those values. Step 2 is the point of this group: it lets you build a connect form, or generate a Terraform resource, without hardcoding one credential shape per integration. Integrations whose connection schema Lumos cannot describe yet return 404. - name: Apps description: > An app is an integration you have connected, one per connected instance of a service. Your Okta tenant is an app. A second Slack workspace is a second app. ### Connecting one 1. `GET /v1/integrations/{app_class_id}/connection-schema` to see which `auth` and `settings` keys the integration expects. 2. `POST /v1/apps` with those credentials. Apps whose credentials validate right away connect and start an initial sync. Apps that need browser consent are finished in the Lumos UI. 3. `GET /v1/apps/{app_uuid}` to follow `sync_status`. 4. `POST /v1/apps/{app_uuid}/sync` to resync later. Only one sync runs per app at a time, so a second request while one is in flight returns 409. Rotate credentials with `PUT /v1/apps/{app_uuid}`. `DELETE /v1/apps/{app_uuid}` drops the stored credentials and returns the app to a connectable state. ### Reading apps `expand` is opt-in and evaluated per field: ask for `admins`, `custom_attributes`, `appstore_settings`, or any of the three workflow slots. A field you lack permission to read is left out of the response instead of failing the whole request, so a 200 does not prove every field you asked for came back. To reconcile the apps you manage from automation such as Terraform, combine `connection_source=API` with `disconnected=false`. ### Workflow slots Each app carries three bindings: an approval workflow, a default provisioning workflow, and a default deprovisioning workflow. The two `default_` slots supply the workflow that entitlements on the app fall back to. To bind a workflow to one entitlement instead, use the Entitlements endpoints. - name: Entitlements description: > An entitlement is a grantable unit of access on an app: a role, a license tier, a group, a permission. Accounts hold entitlements. - `POST /v1/entitlements` creates a requestable entitlement on an app. - `GET /v1/apps/{app_uuid}/entitlements` lists the entitlements on one app. - `GET /v1/entitlements/{entitlement_uuid}/accounts` lists who currently holds one. - `PATCH /v1/entitlements/{entitlement_uuid}` renames it. `label` is the only field you can change today, and sending any other field returns 400. - `DELETE /v1/entitlements/{entitlement_uuid}` refuses while the entitlement is still held, returning 409 with an `active_accounts` count. ### Per-entitlement workflows Three slots bind a workflow to a single entitlement rather than to the whole app: an approval override, a provisioning workflow, and a deprovisioning workflow. Each has a GET and a PUT. Not every entitlement supports them. An entitlement with no request configuration behind it returns 404 with `Workflows are not available for this entitlement.` on all six. - name: Accounts description: > An account is a person's presence inside a connected app. Accounts arrive through sync; you cannot create one through this API. `GET /v1/accounts/{account_uuid}/entitlements` lists what one account holds. It reads the same relationship as `GET /v1/entitlements/{entitlement_uuid}/accounts`, from the account's side rather than the entitlement's. - name: Workflows description: > A workflow is a reusable definition of the steps Lumos runs to approve a request, provision access, or deprovision it. Create the definition here, then bind it to an app or an entitlement through their own workflow endpoints. ### Building one 1. `GET /v1/workflow-steps?app_id={app_uuid}` to discover the steps available for that app, each with the input schema it accepts. 2. `POST /v1/workflows` with the steps you want. 3. Bind it, for example with `PUT /v1/apps/{app_uuid}/default-provisioning-workflow`. `type` and `app_id` are fixed at creation. `PUT /v1/workflows/{workflow_id}` rejects changes to either. ### Workflows this API cannot describe Some workflows Lumos builds for you, including the out-of-the-box provisioning defaults, contain steps with no public representation. `GET /v1/workflows` skips them, so a page can hold fewer items than `page_size` while more results remain. Treat an absent `next_page_token`, not a short page, as the end of the list. Binding one of these to a slot returns 400. - name: Custom Attribute Definitions description: > Custom attributes are the extra fields your organization keeps on users and accounts. These endpoints read their *definitions*, not the values stored against any particular user. `GET /v1/custom-attribute-definitions` returns one entry per label, unified across every app that supplies it. Narrow the list with `config_type` to separate user attributes from account attributes, with `source_type` to tell attributes synced from an app apart from ones your team created, or with `app_id` to see only what a single app supplies. - name: Knowledge description: > Knowledge entries are the documents and notes Lumos agents draw on when they answer access questions. Each entry carries a title, body, tags, and product scopes, plus an optional file attachment. Because of that attachment, create and update send `multipart/form-data` rather than JSON. On update, tag and scope lists replace what was there instead of appending, and `clear_attachment=true` removes an existing file without uploading a replacement. `DELETE` archives rather than destroys. The entry stops appearing in list results and stays recoverable. Pages here are small: `page_size` defaults to 10 and is clamped to 25. paths: /apps/{app_id}/settings: patch: tags: - Core summary: Update Domain App Appstore Settings description: Update app settings. operationId: updateAppSettings parameters: - name: app_id in: path required: true schema: type: string title: App Id requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AppSettingInput' responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/AppSettingOutput' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - HTTPBearer: [] components: schemas: AppSettingInput: properties: custom_request_instructions: type: string title: Custom Request Instructions description: AppStore App instructions that are shown to the requester. redirect_url: anyOf: - type: string maxLength: 2048 - type: 'null' title: Redirect Url description: >- If set, requesting this app redirects the user to this URL instead of going through the normal access-request flow. Send null to clear an existing redirect; omit the field to leave it unchanged. Max 2048 characters. request_flow: $ref: '#/components/schemas/AppStoreAppSettingsRequestFlowInput' description: Request flow configuration to request access to app. provisioning: $ref: '#/components/schemas/AppStoreAppSettingsProvisioningInput' description: Provisioning flow configuration to request access to app. in_app_store: type: boolean title: In App Store description: Whether the app is in the app store. default: false type: object title: AppSettingInput AppSettingOutput: properties: custom_request_instructions: type: string title: Custom Request Instructions description: AppStore App instructions that are shown to the requester. redirect_url: anyOf: - type: string maxLength: 2048 - type: 'null' title: Redirect Url description: >- If set, requesting this app redirects the user to this URL instead of going through the normal access-request flow. Send null to clear an existing redirect; omit the field to leave it unchanged. Max 2048 characters. request_flow: $ref: '#/components/schemas/AppStoreAppSettingsRequestFlowOutput' description: Request flow configuration to request access to app. provisioning: $ref: '#/components/schemas/AppStoreAppSettingsProvisioningOutput' description: Provisioning flow configuration to request access to app. in_app_store: type: boolean title: In App Store description: Whether the app is in the app store. default: false type: object title: AppSettingOutput HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError AppStoreAppSettingsRequestFlowInput: properties: discoverability: $ref: '#/components/schemas/AppStoreVisibility' description: AppStore App visibility. custom_approval_message: type: string title: Custom Approval Message description: >- After the approval step, send a custom message to requesters. Markdown for links and text formatting is supported. require_manager_approval: type: boolean title: Require Manager Approval description: >- When a user makes an access request, require that their manager approves the request before moving on to additional approvals. require_additional_approval: type: boolean title: Require Additional Approval description: >- When true, enables a second approval stage so requests require approval from both stage 1 and stage 2 approvers. When false, disables the second approval stage and merges any existing stage 2 approvers into stage 1. When omitted, the current multi-stage approval setting is left unchanged. allowed_groups: anyOf: - $ref: '#/components/schemas/AllowedGroupsConfigInput' - type: 'null' description: The allowed groups associated with this config. approvers: $ref: '#/components/schemas/AppApproversInput' description: AppStore App approvers assigned. approvers_stage_2: $ref: '#/components/schemas/AppApproversInput' description: AppStore App stage 2 approvers assigned. admins: $ref: '#/components/schemas/AppAdminsInput' description: AppStore App admins assigned. request_validation_inline_webhook: anyOf: - $ref: '#/components/schemas/BaseInlineWebhook' - type: 'null' description: >- A request validation webhook can be optionally associated with this app. type: object title: AppStoreAppSettingsRequestFlowInput AppStoreAppSettingsProvisioningInput: properties: groups_provisioning: $ref: '#/components/schemas/GroupProvisioningOption' description: >- Controls how access is provisioned when a request is fulfilled. DIRECT_TO_USER provisions access at the app level and marks all permissions as not visible in the App Store. GROUPS_AND_HIDDEN provisions access at the permission level, but users cannot select which permission they want (requires at least one visible permission). GROUPS_AND_VISIBLE provisions access at the permission level and allows users to select the permission when requesting (requires at least one visible permission). time_based_access: items: type: string type: array title: Time Based Access description: >- If enabled, users can request an app for a selected duration. After expiry, Lumos will automatically remove user's access. allow_multiple_permission_selection: type: boolean title: Allow Multiple Permission Selection description: >- Whether the app is configured to allow users to request multiple permissions in a single request manual_steps_needed: type: boolean title: Manual Steps Needed description: >- If enabled, Lumos will notify the App Admin after initial access is granted to perform additional manual steps. Note that if this option is enabled, this action must be confirmed by the App Admin in order to resolve the request. custom_provisioning_instructions: anyOf: - type: string - type: 'null' title: Custom Provisioning Instructions description: >- Only Available if manual steps is active. During the provisioning step, Lumos will send a custom message to app admins explaining how to provision a user to the app. Markdown for links and text formatting is supported. default_time_based_access_option: anyOf: - type: string - type: 'null' title: Default Time Based Access Option description: >- The label of the default time-based access duration pre-selected when a user requests access. Must be one of the values in time_based_access. Null when there is no default. default_permission: anyOf: - $ref: '#/components/schemas/RequestablePermissionBase' - type: 'null' description: >- The default permission pre-selected when a user requests access to this app. Provide the permission's id (UUID). Null when there is no default. The permission must belong to this app. provisioning_webhook: anyOf: - $ref: '#/components/schemas/BaseInlineWebhook' - type: 'null' description: The provisioning webhook optionally associated with this app. access_removal_inline_webhook: anyOf: - $ref: '#/components/schemas/BaseInlineWebhook' - type: 'null' description: A deprovisioning webhook can be optionally associated with this app. type: object title: AppStoreAppSettingsProvisioningInput AppStoreAppSettingsRequestFlowOutput: properties: discoverability: $ref: '#/components/schemas/AppStoreVisibility' description: AppStore App visibility. custom_approval_message: type: string title: Custom Approval Message description: >- After the approval step, send a custom message to requesters. Markdown for links and text formatting is supported. require_manager_approval: type: boolean title: Require Manager Approval description: >- When a user makes an access request, require that their manager approves the request before moving on to additional approvals. require_additional_approval: type: boolean title: Require Additional Approval description: >- When true, enables a second approval stage so requests require approval from both stage 1 and stage 2 approvers. When false, disables the second approval stage and merges any existing stage 2 approvers into stage 1. When omitted, the current multi-stage approval setting is left unchanged. allowed_groups: anyOf: - $ref: '#/components/schemas/AllowedGroupsConfigOutput' - type: 'null' description: The allowed groups config associated with this config. default: type: ALL_GROUPS groups: [] approvers: $ref: '#/components/schemas/AppApproversOutput' description: AppStore App approvers assigned. default: groups: [] users: [] approvers_stage_2: $ref: '#/components/schemas/AppApproversOutput' description: AppStore App stage 2 approvers assigned. default: groups: [] users: [] response_describes_entire_approval_workflow: type: boolean title: Response Describes Entire Approval Workflow description: >- Indicates whether the approval configuration is fully represented by the existing API. If False, the approval configuration may contain additional stages or conditional approval chains not reflected in the v1 API. default: false admins: $ref: '#/components/schemas/AppAdminsOutput' description: AppStore App admins assigned. default: [] request_validation_inline_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: >- A request validation webhook can be optionally associated with this config. type: object title: AppStoreAppSettingsRequestFlowOutput AppStoreAppSettingsProvisioningOutput: properties: groups_provisioning: $ref: '#/components/schemas/GroupProvisioningOption' description: >- Controls how access is provisioned when a request is fulfilled. DIRECT_TO_USER provisions access at the app level and marks all permissions as not visible in the App Store. GROUPS_AND_HIDDEN provisions access at the permission level, but users cannot select which permission they want (requires at least one visible permission). GROUPS_AND_VISIBLE provisions access at the permission level and allows users to select the permission when requesting (requires at least one visible permission). time_based_access: items: type: string type: array title: Time Based Access description: >- If enabled, users can request an app for a selected duration. After expiry, Lumos will automatically remove user's access. allow_multiple_permission_selection: type: boolean title: Allow Multiple Permission Selection description: >- Whether the app is configured to allow users to request multiple permissions in a single request manual_steps_needed: type: boolean title: Manual Steps Needed description: >- If enabled, Lumos will notify the App Admin after initial access is granted to perform additional manual steps. Note that if this option is enabled, this action must be confirmed by the App Admin in order to resolve the request. custom_provisioning_instructions: anyOf: - type: string - type: 'null' title: Custom Provisioning Instructions description: >- Only Available if manual steps is active. During the provisioning step, Lumos will send a custom message to app admins explaining how to provision a user to the app. Markdown for links and text formatting is supported. default_time_based_access_option: anyOf: - type: string - type: 'null' title: Default Time Based Access Option description: >- The label of the default time-based access duration pre-selected when a user requests access. Must be one of the values in time_based_access. Null when there is no default. default_permission: anyOf: - $ref: '#/components/schemas/RequestablePermissionOutput' - type: 'null' description: >- The default permission pre-selected when a user requests access to this app. Null if no default is configured. provisioning_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: The provisioning webhook optionally associated with this config. access_removal_inline_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: >- A deprovisioning webhook can be optionally associated with this config. type: object title: AppStoreAppSettingsProvisioningOutput ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError AppStoreVisibility: type: string enum: - FULL - LIMITED - NONE title: AppStoreVisibility AllowedGroupsConfigInput: properties: type: $ref: '#/components/schemas/AllowedGroupsConfigType' description: >- The type of this allowed groups config, can be all groups or specific. default: ALL_GROUPS groups: items: $ref: '#/components/schemas/BaseGroup' type: array title: Groups description: The groups allowed to request this permission. type: object title: AllowedGroupsConfigInput AppApproversInput: properties: groups: items: $ref: '#/components/schemas/BaseGroup' type: array title: Groups description: Groups assigned as support request approvers. default: [] users: items: $ref: '#/components/schemas/BaseUser' type: array title: Users description: Users assigned as support request approvers. default: [] type: object title: AppApproversInput AppAdminsInput: properties: groups: items: $ref: '#/components/schemas/BaseGroup' type: array title: Groups description: Groups assigned as app admins. users: items: $ref: '#/components/schemas/BaseUser' type: array title: Users description: Users assigned as app admins. type: object title: AppAdminsInput BaseInlineWebhook: properties: id: type: string title: Id description: The ID of this inline webhook. type: object required: - id title: BaseInlineWebhook GroupProvisioningOption: type: string enum: - DIRECT_TO_USER - GROUPS_AND_HIDDEN - GROUPS_AND_VISIBLE title: GroupProvisioningOption RequestablePermissionBase: properties: id: type: string title: Id description: The ID of this requestable permission. type: object title: RequestablePermissionBase AllowedGroupsConfigOutput: properties: type: $ref: '#/components/schemas/AllowedGroupsConfigType' description: >- The type of this allowed groups config, can be all groups or specific. default: ALL_GROUPS groups: items: $ref: '#/components/schemas/Group' type: array title: Groups description: The groups allowed to request this permission. default: [] type: object title: AllowedGroupsConfigOutput AppApproversOutput: properties: groups: items: $ref: '#/components/schemas/Group' type: array title: Groups description: Groups assigned as support request approvers. default: [] users: items: $ref: '#/components/schemas/User' type: array title: Users description: Users assigned as support request approvers. default: [] type: object title: AppApproversOutput AppAdminsOutput: properties: groups: items: $ref: '#/components/schemas/Group' type: array title: Groups description: Groups assigned as app admins. default: [] users: items: $ref: '#/components/schemas/User' type: array title: Users description: Users assigned as app admins. default: [] type: object title: AppAdminsOutput InlineWebhook: properties: id: type: string title: Id description: The ID of this inline webhook. hook_type: $ref: '#/components/schemas/InlineWebhookType' description: The type of this inline webhook. name: type: string title: Name description: The name of this inline webhook. description: anyOf: - type: string - type: 'null' title: Description description: The description of this inline webhook. type: object required: - id - hook_type - name title: InlineWebhook RequestablePermissionOutput: properties: id: type: string title: Id description: The ID of this requestable permission. type: anyOf: - $ref: '#/components/schemas/PermissionType' - type: 'null' description: The type of this requestable permission. label: type: string title: Label description: The label of this requestable permission. app_id: type: string title: App Id description: The ID of the app associated with this requestable permission. app_class_id: type: string title: App Class Id description: >- The non-unique ID of the service associated with this requestable permission. Depending on how it is sourced in Lumos, this may be the app's name, website, or other identifier. app_instance_id: type: string title: App Instance Id description: >- The ID of the instance associated with this requestable permission. This may be an empty string. request_config: $ref: '#/components/schemas/RequestConfigOutput' description: The request config associated with this requestable permission. type: object required: - label - app_id - app_class_id - app_instance_id title: RequestablePermissionOutput AllowedGroupsConfigType: type: string enum: - ALL_GROUPS - SPECIFIED_GROUPS title: AllowedGroupsConfigType BaseGroup: properties: id: anyOf: - type: string - type: 'null' title: Id description: The ID of this group. app_id: anyOf: - type: string - type: 'null' title: App Id description: The ID of the app that sources this group. integration_specific_id: anyOf: - type: string - type: 'null' title: Integration Specific Id description: The ID of this group, specific to the integration. type: object title: BaseGroup BaseUser: properties: id: type: string title: Id description: The ID of this user. type: object required: - id title: BaseUser Group: properties: id: anyOf: - type: string - type: 'null' title: Id description: The ID of this group. app_id: anyOf: - type: string - type: 'null' title: App Id description: The ID of the app that sources this group. integration_specific_id: anyOf: - type: string - type: 'null' title: Integration Specific Id description: The ID of this group, specific to the integration. name: anyOf: - type: string - type: 'null' title: Name description: The name of this group. description: anyOf: - type: string - type: 'null' title: Description description: The description of this group. group_lifecycle: anyOf: - $ref: '#/components/schemas/Lifecycle' - type: 'null' description: The lifecycle of this group. default: SYNCED source_app_id: anyOf: - type: string - type: 'null' title: Source App Id description: The ID of the app that sources this group. type: object title: Group User: properties: id: type: string title: Id description: The ID of this user. email: anyOf: - type: string - type: 'null' title: Email description: The email of this user. given_name: anyOf: - type: string - type: 'null' title: Given Name description: The given name of this user. family_name: anyOf: - type: string - type: 'null' title: Family Name description: The family name of this user. status: anyOf: - $ref: '#/components/schemas/UserLifecycleStatus' - type: 'null' description: The status of this user. type: object required: - id title: User InlineWebhookType: type: string enum: - PRE_APPROVAL - PROVISION - DEPROVISION - REQUEST_VALIDATION - SIEM title: InlineWebhookType PermissionType: type: string enum: - SYNCED - NATIVE title: PermissionType RequestConfigOutput: properties: appstore_visibility: anyOf: - $ref: '#/components/schemas/AppStoreVisibilityOption' - type: 'null' description: The appstore visibility of this request config. default: HIDDEN allowed_groups_override: anyOf: - type: boolean - type: 'null' title: Allowed Groups Override description: >- Indicates if allowed groups is overriden from the app-level settings. allowed_groups: anyOf: - $ref: '#/components/schemas/AllowedGroupsConfigOutput' - type: 'null' description: The allowed groups config associated with this config. default: type: ALL_GROUPS groups: [] request_approval_config: anyOf: - $ref: '#/components/schemas/RequestApprovalConfigOutput' - type: 'null' description: >- A request approval config can be optionally associated with this config default: manager_approval: NONE request_approval_stages: - {} request_fulfillment_config: anyOf: - $ref: '#/components/schemas/RequestFulfillmentConfigOutput' - type: 'null' description: >- A request fulfillment config can be optionally associated with this config default: {} access_removal_inline_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: >- A deprovisioning webhook can be optionally associated with this config. request_validation_inline_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: >- A request validation webhook can be optionally associated with this config. type: object title: RequestConfigOutput Lifecycle: type: string enum: - SYNCED - NATIVE title: Lifecycle UserLifecycleStatus: type: string enum: - STAGED - ACTIVE - SUSPENDED - INACTIVE title: UserLifecycleStatus AppStoreVisibilityOption: type: string enum: - HIDDEN - VISIBLE title: AppStoreVisibilityOption RequestApprovalConfigOutput: properties: request_approval_config_override: anyOf: - type: boolean - type: 'null' title: Request Approval Config Override description: Indicates if approval flow is overridden. manager_approval: anyOf: - $ref: '#/components/schemas/ManagerApprovalOption' - type: 'null' description: Manager approval can be configured as necessary to continue default: NONE require_additional_approval: anyOf: - type: boolean - type: 'null' title: Require Additional Approval description: >- When true, enables a second approval stage so requests require approval from both stage 1 and stage 2 approvers. When false, disables the second approval stage and merges any existing stage 2 approvers into stage 1. When omitted, the current multi-stage approval setting is left unchanged. custom_approval_message: anyOf: - type: string - type: 'null' title: Custom Approval Message description: >- After the approval step, send a custom message to requesters. Note that the permission level approval message will override the App level approval message if custom_approval_message_override is set. Markdown for links and text formatting is supported. custom_approval_message_override: anyOf: - type: boolean - type: 'null' title: Custom Approval Message Override description: Indicates if custom_approval_message is overridden. approvers: anyOf: - $ref: '#/components/schemas/AppApproversOutput' - type: 'null' description: AppStore App approvers assigned. approvers_stage_2: anyOf: - $ref: '#/components/schemas/AppApproversOutput' - type: 'null' description: AppStore App stage 2 approvers assigned. request_approval_stages: anyOf: - items: $ref: '#/components/schemas/RequestApprovalStageOutput' type: array - type: 'null' title: Request Approval Stages description: The stages of this request approval. default: - {} response_describes_entire_approval_workflow: anyOf: - type: boolean - type: 'null' title: Response Describes Entire Approval Workflow description: >- Indicates whether the approval configuration is fully represented by the existing API. If False, the approval configuration may contain additional stages or conditional approval chains not reflected in the v1 API. type: object title: RequestApprovalConfigOutput RequestFulfillmentConfigOutput: properties: manual_steps_needed: anyOf: - type: boolean - type: 'null' title: Manual Steps Needed description: Whether manual steps are needed. manual_instructions: anyOf: - type: string - type: 'null' title: Manual Instructions description: The manual instructions that go along. time_based_access: items: type: string type: array title: Time Based Access description: >- If enabled, users can request an app for a selected duration. After expiry, Lumos will automatically remove user's access. time_based_access_override: anyOf: - type: boolean - type: 'null' title: Time Based Access Override description: Indicates if time based access is overriden. provisioning_group: anyOf: - $ref: '#/components/schemas/Group' - type: 'null' description: The provisioning group optionally assocated with this config. provisioning_webhook: anyOf: - $ref: '#/components/schemas/InlineWebhook' - type: 'null' description: The provisioning webhook optionally associated with this config. type: object title: RequestFulfillmentConfigOutput ManagerApprovalOption: type: string enum: - NONE - INITIAL_APPROVAL title: ManagerApprovalOption RequestApprovalStageOutput: properties: approvers: anyOf: - items: $ref: '#/components/schemas/ApproverOutput' type: array - type: 'null' title: Approvers description: The approvers of this stage. type: object title: RequestApprovalStageOutput ApproverOutput: properties: type: $ref: '#/components/schemas/ApproverType' description: The type of this approver. user: anyOf: - $ref: '#/components/schemas/User' - type: 'null' description: Optionally, the approver can be a user. group: anyOf: - $ref: '#/components/schemas/Group' - type: 'null' description: Optionally, the approver can be a group. type: object required: - type title: ApproverOutput ApproverType: type: string enum: - USER - GROUP title: ApproverType securitySchemes: HTTPBearer: type: http scheme: bearer ````