Skip to main content

Create a JML role​

Create a JML role

Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Request Body required
  • name string required

    Possible values: <= 120 characters

  • description string

    Possible values: <= 1000 characters

  • owner string
  • entitlements object[]

    Possible values: <= 200

  • type string required

    Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

    Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

  • id string

    Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

    Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

    Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

  • name string

    Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

  • connection string

    Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

  • granting_type string

    Used by grant, revoke — e.g. "okta_group".

  • granting_id string

    Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

  • granting_id_ref object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • subject object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • role_id string

    Used by role. The JMLRole whose entitlements are granted.

  • target string

    Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

  • channel string

    Used by notify — e.g. "email", "slack".

  • to string

    Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

  • provider string

    Used by ticket — e.g. "jira", "servicenow".

  • params object

    Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

    A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

  • enabled boolean

    Default value: true

    When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

Responses

Created

Schema
  • meta object
  • pagination object
  • limit integer
  • offset integer
  • total_count int64
  • cursor_pagination object

    Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  • limit integer
  • next_cursor string

    Opaque token addressing the next page. Absent on the last page.

  • prev_cursor string

    Opaque token addressing the previous page. Absent on the first page.

  • last_cursor string

    Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  • total_count int64

    Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

  • errors object[]
  • httpcode integer
  • message string
  • code string

    Machine-readable reason, present only for errors that define one. Values today: unserved_org_region (the organization is homed in a region this deployment does not serve), wrong_region (the request must be sent to the organization's home region), region_route_missing (this instance has no route to the organization's home region).

  • result object
  • id string
  • name string
  • description string
  • owner string

    Person id of the owner. Defaults to created_by.

  • entitlements object[]

    Steps of type grant only in this release.

  • type string

    Possible values: [grant, revoke, disable, notify, ticket, webhook, condition, provision, role, access_review]

    Step vocabulary. grant/revoke are only valid in the access phase (grant is additionally rejected on a leaver policy); the rest are valid in before/after. role assigns every entitlement of a JMLRole; access phase only, joiner and mover. access_review opens and starts an access review of the person the event is about, configured by its string params: reviewer (one email; that person reviews), else the person's manager, which requires fallback_reviewer (email) for anyone without one; one of the two must be set. review_window_days (1-365, default 14). While that review is open, the step opens no second one for the same person. On a leaver the review usually finds nothing left to decide once the access phase has revoked it, and closes as nothing_to_review.

  • id string

    Possible values: Value must match regular expression ^[a-z0-9][a-z0-9_-]{0,63}$

    Stable identity of the step; never regenerated once assigned. Optional until the policy contains its first reference: a step with no id still compiles, using its position in the phase ("before-0", etc.) as its action id. Once ANY step carries a subject, a granting_id_ref, a ValueRef param or a {{.steps.…}} template, every enabled step needs an id, because references resolve through them.

    Uniqueness is enforced over EFFECTIVE ids across all three phases: an explicit id may not equal another step's positional id either (an explicit "before-1" beside an unnamed second before step is rejected). It must not equal the reserved id "access-policy".

  • name string

    Optional display label for the step. Defaults to the catalogue label for the step's type when omitted.

  • connection string

    Used by grant, revoke, disable, provision. For an enabled grant/revoke/disable step with no subject binding, the connection's platform must match the platform of EVERY trigger.source_connections entry — such a step acts on the triggering identity, and the engine resolves the provider action from that identity's platform, so a cross-provider step would never run. Bind a subject from a provision step, or split the policy per source. Unrelated to provision, whose target platform is the step's own.

  • granting_type string

    Used by grant, revoke — e.g. "okta_group".

  • granting_id string

    Used by grant, revoke. Exactly one of granting_id and granting_id_ref is set.

  • granting_id_ref object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • subject object

    A reference to a value that is not known when the policy is authored. Exactly one origin is set: from_step together with output (an earlier step's declared output — see the step catalogue's outputs), or from_trigger (a value of the triggering identity). Setting both, neither, or from_step without output is rejected on write.

    from_trigger names either one of the well-known lifecycle values (identifier, display_name, email, source_identifier) or attributes.<key>, where <key> must be discoverable on EVERY trigger source connection.

  • from_step string

    The id of an earlier step in the policy's chain.

  • output string

    The name of an output that step declares.

  • from_trigger string

    A value of the triggering identity, e.g. "email" or "attributes.department".

  • role_id string

    Used by role. The JMLRole whose entitlements are granted.

  • target string

    Used by provision — the kind of resource to create, e.g. "aws_account". See JMLSource's description for the set supported in this release.

  • channel string

    Used by notify — e.g. "email", "slack".

  • to string

    Used by notify. A literal recipient (email address, phone number, Slack channel) — role words like "manager" are rejected at compile time; there is no recipient templating.

  • provider string

    Used by ticket — e.g. "jira", "servicenow".

  • params object

    Freeform per-step configuration for step types with no typed fields of their own (webhook, condition), plus optional detail for ones that do (ticket). A value may be a ValueRef object instead of a literal, binding the parameter to an earlier step's output or to a value of the triggering identity; the engine resolves it at run time so the provider always receives a literal.

    A ValueRef param is valid only on the step types whose compiled action carries bindings — provision, grant, revoke, disable. On notify, ticket, webhook and condition it is rejected; reference an earlier step from those steps' template fields instead ({{.steps.<id>.<output>}}, with - in the id written as _).

  • enabled boolean

    Default value: true

    When false the step is kept in the source but skipped entirely at compile time — it produces no action node. Lets a step be turned off without deleting it. Omitted means enabled.

  • created_by string
  • created_at date-time
  • updated_by string
  • updated_at date-time