Skip to main content

Catalogue of JML steps available per connected platform​

Returns, for every connection a JML step can act on, the step kinds it supports — derived from the registered remediation recipes and provisioning targets, so the palette only offers what the engine can dispatch. Each entry maps directly onto a JMLStep: type, and for grant/revoke the granting_type, for provision the target, for notify the channel, for ticket the provider — plus the phases it may be authored in and the params its recipe reads. The response also carries the notify channels and ticket providers the compiler accepts, so the builder never keeps its own copy of either list. builtin_steps publishes the output descriptors of the step kinds that never appear under a connection (ticket, webhook) — one entry per (type, provider) pair, so the builder never keeps its own copy of what those steps produce either.

Query Parameters
  • lifecycle string

    Possible values: [joiner, mover, leaver, risk_signal]

    Narrow to steps valid for this lifecycle and compute each step's phases for it. Omitted means joiner, the most permissive lifecycle.

Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Responses

Step catalogue grouped by connection

Schema
  • meta object
  • pagination object
  • limit integer
  • offset integer
  • total_count int64
  • cursor_pagination object

    Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  • limit integer
  • next_cursor string

    Opaque token addressing the next page. Absent on the last page.

  • prev_cursor string

    Opaque token addressing the previous page. Absent on the first page.

  • last_cursor string

    Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  • total_count int64

    Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

  • errors object[]
  • httpcode integer
  • message string
  • code string

    Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

  • result object
  • connections object[]
  • connection_id string
  • provider string

    Connection source type, e.g. okta_org, jira, slack.

  • display_name string

    Connection name as shown in the palette card.

  • steps object[]
  • type string

    Possible values: [grant, revoke, disable, notify, ticket, webhook, provision, access_review]

    The JMLStep.type this entry produces.

  • label string

    Palette label, e.g. "Add to group", "Open ticket".

  • phases string[]

    Possible values: [before, access, after]

    The phases an authored step of this kind may be placed in, for the requested lifecycle (joiner when none was given). Empty means the step is not authorable on that lifecycle at all. This is the same rule JMLSource validation and the compiler apply.

  • params object[]

    The parameters the dispatching recipe reads, from the recipe registry. A param with auto true is filled by the engine from the triggering identity or the step's own target and needs no authoring; one with auto false has to be supplied in JMLStep.params under name.

  • name string

    The JMLStep.params key, e.g. "group_name".

  • required boolean

    The recipe cannot dispatch without a value.

  • auto boolean

    The engine fills this from the triggering identity or the step's target (connection, granting_id), so the author never supplies it.

  • type string

    Possible values: [string]

    Always "string" today — declared so the picker's from_step-output compatibility rule (matching a param's type against an upstream output's type) is data, not a client-side convention.

  • template boolean

    Marks a param whose value may be a template string the engine interpolates rather than a plain value. False everywhere today, and no rendering path exists behind it: no recipe declares a template param, and a param value reaches the provider verbatim. Published so the builder's field rendering is catalogue-driven when one does.

  • granting_type string

    For grant/revoke — the JMLStep.granting_type, e.g. "okta_group".

  • target string

    For provision — the JMLStep.target, e.g. "aws_account".

  • channel string

    For notify — the JMLStep.channel.

  • provider string

    For ticket — the JMLStep.provider.

  • subject_bindable boolean

    Whether an authored step of this kind may carry a subject binding — true for grant, revoke and disable. phases above describes the step KIND, which carries no binding yet: a subject-bound step is always a before/after step, whatever phases says.

  • outputs object[]

    The values a completed step of this kind makes available to a later step's from_step reference. Empty means the step declares nothing to reference — true for grant/revoke/disable today; only provision (via the recipe registry) declares any.

  • name string

    The output key a from_step reference names, e.g. "role_arn".

  • type string

    Possible values: [string, identity]

    The output value's shape. A string output fills a param, a granting_id_ref or a template. An identity output is what a subject binding must reference; in a template it is addressed as {{.steps.<id>.<name>.external_id}} (any field of the identity works) or {{.steps.<id>.<name>_id}} — naming it bare is rejected, since an identity is not a string.

  • description string
  • notify_channels string[]

    The JMLStep.channel values a notify step accepts.

  • ticket_providers string[]

    The JMLStep.provider values a ticket step accepts.

  • builtin_steps object[]

    Output descriptors for the step kinds that never go through the recipe registry (ticket, webhook) and so never appear under a connection — one entry per (type, provider) pair.

  • type string

    Possible values: [grant, revoke, disable, notify, ticket, webhook, provision]

    The JMLStep.type this entry describes.

  • provider string

    For ticket — the JMLStep.provider this entry describes, e.g. "jira".

  • channel string

    For notify — reserved for a future notify variant that declares outputs; unused today.

  • outputs object[]

    What a completed step of this kind makes available to a later step's from_step reference. The webhook entry is VOCABULARY ONLY: nothing consumes the webhook event yet, so no completion ever carries those values and a step referencing them fails at run time.

  • name string

    The output key a from_step reference names, e.g. "role_arn".

  • type string

    Possible values: [string, identity]

    The output value's shape. A string output fills a param, a granting_id_ref or a template. An identity output is what a subject binding must reference; in a template it is addressed as {{.steps.<id>.<name>.external_id}} (any field of the identity works) or {{.steps.<id>.<name>_id}} — naming it bare is rejected, since an identity is not a string.

  • description string