Access Controls API Application Roles Reference
Assign one of the following predefined roles for performing API operations.
| Method | Path | Application Roles (Unrestricted) | Application Roles (Restricted) |
|---|---|---|---|
| POST | /access-governance/access-controls/20250331/accessBundles/ | AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted |
|
| GET | /access-governance/access-controls/20250331/accessBundles/ | AG_AccessControl_Admin, AG_Administrator, AG_Auditor |
AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/accessBundles/{accessBundleId} | AG_AccessControl_Admin, AG_Administrator, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| PUT | /access-governance/access-controls/20250331/accessBundles/{accessBundleId} | AG_AccessControl_Admin, AG_Administrator |
AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| DELETE | /access-governance/access-controls/20250331/accessBundles/{accessBundleId} | AG_AccessControl_Admin, AG_Administrator |
AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| PATCH | /access-governance/access-controls/20250331/accessBundles/{accessBundleId}/activate | AG_AccessControl_Admin, AG_Administrator |
AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/accessGuardrails/ | AG_AccessControl_Admin, AG_Administrator, AG_Auditor, AG_Enterprise_Wide_Access_Admin |
AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| POST | /access-governance/access-controls/20250331/accessGuardrails/analyze | AG_AccessControl_Admin, AG_Administrator |
AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/accessGuardrails/{accessGuardrailId} | AG_AccessControl_Admin, AG_Administrator, AG_Auditor, AG_Enterprise_Wide_Access_Admin, AG_User |
AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| POST | /access-governance/access-controls/20250331/accessRequests/ | AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AgentAdministrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
|
| GET | /access-governance/access-controls/20250331/accessRequests/ | AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AgentAdministrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
|
| POST | /access-governance/access-controls/20250331/accessRequests/extension | AG_ServiceDesk_Admin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/accessRequests/{accessRequestId} | AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AgentAdministrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
|
| GET | /access-governance/access-controls/20250331/approvalWorkflows/ | AG_AccessControl_Admin, AG_Administrator, AG_Auditor, AG_CampaignAdmin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/approvals/ | AG_ServiceDesk_Admin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| POST | /access-governance/access-controls/20250331/approvals/ | AG_ServiceDesk_Admin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/approvals/me | AG_ServiceDesk_Admin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| POST | /access-governance/access-controls/20250331/approvals/workRequest | AG_ServiceDesk_Admin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/approvals/workRequest/{workRequestId} | AG_ServiceDesk_Admin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/approvals/{taskId} | AG_ServiceDesk_Admin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| POST | /access-governance/access-controls/20250331/identityCollections/ | AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator, AG_AgentAdministrator, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin |
|
| GET | /access-governance/access-controls/20250331/identityCollections/ | AG_AccessControl_Admin, AG_Administrator, AG_AgentAdministrator, AG_Auditor, AG_CampaignAdmin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/identityCollections/{identityCollectionId} | AG_AccessControl_Admin, AG_Administrator, AG_AgentAdministrator, AG_Auditor, AG_CampaignAdmin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| DELETE | /access-governance/access-controls/20250331/identityCollections/{identityCollectionId} | AG_AccessControl_Admin, AG_Administrator, AG_AgentAdministrator, AG_CampaignAdmin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| PUT | /access-governance/access-controls/20250331/identityCollections/{identityCollectionId} | AG_AccessControl_Admin, AG_Administrator, AG_AgentAdministrator, AG_CampaignAdmin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/identityCollections/{identityCollectionId}/members | AG_AccessControl_Admin, AG_Administrator, AG_AgentAdministrator, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| POST | /access-governance/access-controls/20250331/permissions/{permissionId}/actions/revoke | AG_Administrator, AG_ServiceDesk_Admin |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| POST | /access-governance/access-controls/20250331/policies/ | AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator |
|
| GET | /access-governance/access-controls/20250331/policies/ | AG_AccessControl_Admin, AG_Administrator, AG_Auditor |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/policies/{policyId} | AG_AccessControl_Admin, AG_Administrator, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| DELETE | /access-governance/access-controls/20250331/policies/{policyId} | AG_AccessControl_Admin, AG_Administrator |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| PUT | /access-governance/access-controls/20250331/policies/{policyId} | AG_AccessControl_Admin, AG_Administrator |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| POST | /access-governance/access-controls/20250331/roles/ | AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_Administrator |
|
| GET | /access-governance/access-controls/20250331/roles/ | AG_AccessControl_Admin, AG_Administrator, AG_Auditor |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| GET | /access-governance/access-controls/20250331/roles/{roleId} | AG_AccessControl_Admin, AG_Administrator, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| PUT | /access-governance/access-controls/20250331/roles/{roleId} | AG_AccessControl_Admin, AG_Administrator |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |
| DELETE | /access-governance/access-controls/20250331/roles/{roleId} | AG_AccessControl_Admin, AG_Administrator |
AG_AccessControl_Admin, AG_AccessControl_Admin_Restricted, AG_AppOwner_Admin, AG_AppOwner_Admin_Restricted, AG_Auditor, AG_CampaignAdmin, AG_Enterprise_Wide_Access_Admin, AG_ServiceDesk_Admin, AG_User |