Creates a new Access Guardrail
post
/access-governance/access-controls/20250331/accessGuardrails
Creates a new Access Guardrail.
Note: Currently, when editing access guardrails via the UI, fields related to condition handling may need to be reapplied.
Request
Header Parameters
-
opc-request-id: string
The client request ID for tracing. The only valid characters for request IDs are letters, numbers, underscore, and dash.
-
opc-retry-token: string
Minimum Length:
1Maximum Length:64A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations. For example, if a resource has been deleted and purged from the system, then a retry of the original creation request might be rejected.
Details for the new access guardrail.
Root Schema : CreateAccessGuardrailDetails
Type:
objectDetails about new Access Guardrail.
Show Source
-
actionOnFailure(required):
object ActionOnFailure
The information about remediation in case of condition failure.
-
description:
string
Minimum Length:
0Maximum Length:4000Description of the Access Guardrail. -
isDetectiveViolationCheckEnabled(required):
boolean
Set to true for enabling detective violation check.
-
name(required):
string
Minimum Length:
1Maximum Length:255Access Guardrail Identifier. -
owners(required):
array owners
List of owner entities.
-
rules(required):
object RuleCollection
Collection of rule.
-
tags:
array tags
Tags for the Access Guardrail.
Nested Schema : ActionOnFailure
Type:
objectThe information about remediation in case of condition failure.
Show Source
-
actionType(required):
string
Allowed Values:
[ "REVOKE_IMMEDIATELY", "REVOKE_LATER" ]Action to be taken in case of access guardrail evaluation results in failure. -
revokeLaterAfterNumberOfDays:
integer
Minimum Value:
0Maximum Value:90Revoke permission after number of days. -
risk:
string
Allowed Values:
[ "HIGH", "LOW" ]Risk associated with action on failure. -
shouldUserManagerBeNotified(required):
boolean
Should the user manager be notified in case of access guardrail evaluation results in failure.
Nested Schema : owners
Type:
arrayList of owner entities.
Show Source
-
Array of:
object OwnerSummary
Owner entity object
Nested Schema : RuleCollection
Type:
objectCollection of rule.
Show Source
-
items(required):
array items
List of rule.
Nested Schema : OwnerSummary
Type:
objectOwner entity object
Show Source
-
id(required):
string
Unique identifier that is immutable on creation
-
isPrimary(required):
boolean
Is this entity the primary owner?
-
name(required):
string
Name of the owner
Nested Schema : items
Type:
arrayList of rule.
Show Source
-
Array of:
object Rule
The information about Rule.
Nested Schema : Rule
Type:
objectThe information about Rule.
Show Source
-
conditions(required):
object ConditionCollection
Collection of conditions.
-
id:
string
AGCS Rule ID. Required when updating guardrail.
-
operator(required):
string
Allowed Values:
[ "AND", "OR" ]Rule operator for the rule. -
type(required):
string
Allowed Values:
[ "DEFAULT" ]Type of rule used for parsing the rule.
Nested Schema : ConditionCollection
Type:
objectCollection of conditions.
Show Source
-
items(required):
array items
List of condition.
Nested Schema : items
Type:
arrayList of condition.
Show Source
-
Array of:
object Condition
The information about Condition.
Nested Schema : Condition
Type:
objectThe information about Condition.
Show Source
-
additionalAttributes:
object additionalAttributes
Additional Properties Allowed: additionalPropertiesAdditional attributes for additional information related to the condition.
-
basicCondition(required):
object BasicCondition
The information about condition.
-
childConditions:
object BasicConditionCollection
Collection of conditions.
-
type(required):
string
Allowed Values:
[ "IDENTITY_ATTRIBUTE", "PERMISSION", "DOES_NOT_HAVE_PERMISSION" ]The type for AG Resource.
Nested Schema : additionalAttributes
Type:
objectAdditional Properties Allowed
Show Source
Additional attributes for additional information related to the condition.
Nested Schema : BasicCondition
Type:
objectThe information about condition.
Show Source
-
dataType:
string
Allowed Values:
[ "STRING", "NUMBER", "BOOLEAN", "DATE" ]Data type for the condition identifier (lhs) -
displayName(required):
string
Minimum Length:
1Maximum Length:255Access Guardrails Identifier -
lhs(required):
string
Minimum Length:
1Maximum Length:512Left hand side of the condition. -
operator(required):
string
Allowed Values:
[ "EQ", "NE", "GT", "LT", "GTE", "LTE", "BEFORE", "AFTER", "TILL", "FROM", "BETWEEN", "NOT_BETWEEN", "IN", "NOT_IN", "CONTAINS", "NOT_CONTAINS", "BEGINS_WITH", "NOT_BEGINS_WITH", "ENDS_WITH", "NOT_ENDS_WITH", "IS_NULL", "IS_NOT_NULL", "EQUAL_WITH_NULL" ]The operator for a access guardrail. -
rhs(required):
array rhs
Right hand side of the condition.
Nested Schema : BasicConditionCollection
Type:
objectCollection of conditions.
Show Source
-
items(required):
array items
List of condition.
Nested Schema : items
Type:
arrayList of condition.
Show Source
-
Array of:
object BasicCondition
The information about condition.
Response
Supported Media Types
- application/json
200 Response
The Access Guardrail was successfully created.
Headers
-
etag: string
For optimistic concurrency control. See `if-match`.
-
opc-request-id: string
Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
Root Schema : AccessGuardrail
Type:
objectDescription of AccessGuardrail.
Show Source
-
actionOnFailure:
object ActionOnFailure
The information about remediation in case of condition failure.
-
createdBy:
string
User name of the use who created the AccessGuardrail.
-
description:
string
description of the AccessGuardrail.
-
id(required):
string
The Unique Oracle ID (OCID) that is immutable on creation.
-
isDetectiveViolationCheckEnabled:
boolean
Set to true for enabling detective violation check
-
lifecycleState(required):
string
Allowed Values:
[ "CREATING", "UPDATING", "ACTIVE", "INACTIVE", "DELETING", "DELETED", "FAILED" ]The current state of the AccessGuardrail. -
name:
string
A user-friendly name. Does not have to be unique, and it's changeable. Avoid entering confidential information.
-
owners:
array owners
List of owner entities
-
ownershipCollectionId:
string
Id of the ownership collection associated with the AccessGuardrail.
-
primaryOwnerDisplayName:
string
DisplayName of the primary owner.
-
rules:
object RuleCollection
Collection of rule.
-
tags:
array tags
Tags for the AccessGuardrail.
-
timeCreated:
string(date-time)
The time the the AccessGuardrail was created. An RFC3339 formatted datetime string
-
timeUpdated:
string(date-time)
The time the the AccessGuardrail was updated. An RFC3339 formatted datetime string
-
updatedBy:
string
User name of the use who updated the AccessGuardrail.
Nested Schema : ActionOnFailure
Type:
objectThe information about remediation in case of condition failure.
Show Source
-
actionType(required):
string
Allowed Values:
[ "REVOKE_IMMEDIATELY", "REVOKE_LATER" ]Action to be taken in case of access guardrail evaluation results in failure. -
revokeLaterAfterNumberOfDays:
integer
Minimum Value:
0Maximum Value:90Revoke permission after number of days. -
risk:
string
Allowed Values:
[ "HIGH", "LOW" ]Risk associated with action on failure. -
shouldUserManagerBeNotified(required):
boolean
Should the user manager be notified in case of access guardrail evaluation results in failure.
Nested Schema : owners
Type:
arrayList of owner entities
Show Source
-
Array of:
object OwnerSummary
Owner entity object
Nested Schema : RuleCollection
Type:
objectCollection of rule.
Show Source
-
items(required):
array items
List of rule.
Nested Schema : OwnerSummary
Type:
objectOwner entity object
Show Source
-
id(required):
string
Unique identifier that is immutable on creation
-
isPrimary(required):
boolean
Is this entity the primary owner?
-
name(required):
string
Name of the owner
Nested Schema : items
Type:
arrayList of rule.
Show Source
-
Array of:
object Rule
The information about Rule.
Nested Schema : Rule
Type:
objectThe information about Rule.
Show Source
-
conditions(required):
object ConditionCollection
Collection of conditions.
-
id:
string
AGCS Rule ID. Required when updating guardrail.
-
operator(required):
string
Allowed Values:
[ "AND", "OR" ]Rule operator for the rule. -
type(required):
string
Allowed Values:
[ "DEFAULT" ]Type of rule used for parsing the rule.
Nested Schema : ConditionCollection
Type:
objectCollection of conditions.
Show Source
-
items(required):
array items
List of condition.
Nested Schema : items
Type:
arrayList of condition.
Show Source
-
Array of:
object Condition
The information about Condition.
Nested Schema : Condition
Type:
objectThe information about Condition.
Show Source
-
additionalAttributes:
object additionalAttributes
Additional Properties Allowed: additionalPropertiesAdditional attributes for additional information related to the condition.
-
basicCondition(required):
object BasicCondition
The information about condition.
-
childConditions:
object BasicConditionCollection
Collection of conditions.
-
type(required):
string
Allowed Values:
[ "IDENTITY_ATTRIBUTE", "PERMISSION", "DOES_NOT_HAVE_PERMISSION" ]The type for AG Resource.
Nested Schema : additionalAttributes
Type:
objectAdditional Properties Allowed
Show Source
Additional attributes for additional information related to the condition.
Nested Schema : BasicCondition
Type:
objectThe information about condition.
Show Source
-
dataType:
string
Allowed Values:
[ "STRING", "NUMBER", "BOOLEAN", "DATE" ]Data type for the condition identifier (lhs) -
displayName(required):
string
Minimum Length:
1Maximum Length:255Access Guardrails Identifier -
lhs(required):
string
Minimum Length:
1Maximum Length:512Left hand side of the condition. -
operator(required):
string
Allowed Values:
[ "EQ", "NE", "GT", "LT", "GTE", "LTE", "BEFORE", "AFTER", "TILL", "FROM", "BETWEEN", "NOT_BETWEEN", "IN", "NOT_IN", "CONTAINS", "NOT_CONTAINS", "BEGINS_WITH", "NOT_BEGINS_WITH", "ENDS_WITH", "NOT_ENDS_WITH", "IS_NULL", "IS_NOT_NULL", "EQUAL_WITH_NULL" ]The operator for a access guardrail. -
rhs(required):
array rhs
Right hand side of the condition.
Nested Schema : BasicConditionCollection
Type:
objectCollection of conditions.
Show Source
-
items(required):
array items
List of condition.
Nested Schema : items
Type:
arrayList of condition.
Show Source
-
Array of:
object BasicCondition
The information about condition.
400 Response
Bad Request
Headers
-
opc-request-id: string
Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
Root Schema : Error
Type:
objectError Information.
Show Source
-
code(required):
string
A short error code that defines the error, meant for programmatic parsing.
-
message(required):
string
A human-readable error string.
401 Response
Unauthorized
Headers
-
opc-request-id: string
Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
Root Schema : Error
Type:
objectError Information.
Show Source
-
code(required):
string
A short error code that defines the error, meant for programmatic parsing.
-
message(required):
string
A human-readable error string.
404 Response
Not Found
Headers
-
opc-request-id: string
Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
Root Schema : Error
Type:
objectError Information.
Show Source
-
code(required):
string
A short error code that defines the error, meant for programmatic parsing.
-
message(required):
string
A human-readable error string.
409 Response
Conflict
Headers
-
opc-request-id: string
Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
Root Schema : Error
Type:
objectError Information.
Show Source
-
code(required):
string
A short error code that defines the error, meant for programmatic parsing.
-
message(required):
string
A human-readable error string.
429 Response
Too Many Requests
Headers
-
opc-request-id: string
Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
Root Schema : Error
Type:
objectError Information.
Show Source
-
code(required):
string
A short error code that defines the error, meant for programmatic parsing.
-
message(required):
string
A human-readable error string.
500 Response
Internal Server Error
Headers
-
opc-request-id: string
Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
Root Schema : Error
Type:
objectError Information.
Show Source
-
code(required):
string
A short error code that defines the error, meant for programmatic parsing.
-
message(required):
string
A human-readable error string.
Default Response
Unknown Error
Headers
-
opc-request-id: string
Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.
Root Schema : Error
Type:
objectError Information.
Show Source
-
code(required):
string
A short error code that defines the error, meant for programmatic parsing.
-
message(required):
string
A human-readable error string.
Examples
The following examples shows how to create an Access Guardrails:
Example 1: Employee Type Access Guardrails
Submit a POST request to the following endpoint: ${si}/access-governance/access-controls/${version}/accessGuardrails.
{
"name": "employee-type-access-guardrail",
"description": "Ensures access policies are enforced based on employee type attribute",
"isDetectiveViolationCheckEnabled": true,
"tags": ["identity-attribute"],
"rules": {
"items": [
{
"type": "DEFAULT",
"operator": "AND",
"conditions": {
"items": [
{
"type": "IDENTITY_ATTRIBUTE",
"basicCondition": {
"displayName": "Employee type",
"operator": "EQ",
"lhs": "userType",
"rhs": ["Employee"],
"dataType": "STRING"
},
"childConditions": {
"items": []
},
"additionalAttributes": null
}
]
}
}
]
},
"actionOnFailure": {
"actionType": "REVOKE_LATER",
"risk": "LOW",
"revokeLaterAfterNumberOfDays": 10,
"shouldUserManagerBeNotified": false
},
"owners": [
{
"id": "ocid1.tenancy.oc1..xxxxxxownerid",
"name": "John Doe",
"isPrimary": true
}
]
}Sample Response Payload
You'll get a 200 OK response, with the following payload
{
"id": "ocid1.tenancy.oc1..xxxxxxguardrailid",
"name": "employee-type-access-guardrail",
"description": "Ensures access policies are enforced based on employee type attribute",
"timeCreated": "2026-04-24T14:19:49.181Z",
"timeUpdated": "2026-04-24T14:19:49.181Z",
"lifecycleState": "ACTIVE",
"isDetectiveViolationCheckEnabled": true,
"tags": [
"identity-attribute"
],
"rules": {
"items": [
{
"id": "rule-xxx-1",
"type": "DEFAULT",
"operator": "AND",
"conditions": {
"items": [
{
"type": "IDENTITY_ATTRIBUTE",
"basicCondition": {
"displayName": "Employee type",
"operator": "EQ",
"lhs": "userType",
"rhs": ["Employee"],
"dataType": "STRING"
},
"childConditions": {
"items": []
},
"additionalAttributes": null
}
]
}
}
]
},
"actionOnFailure": {
"actionType": "REVOKE_LATER",
"risk": "LOW",
"revokeLaterAfterNumberOfDays": 10,
"shouldUserManagerBeNotified": false
},
"ownershipCollectionId": "ocid1.tenancy.oc1..xxxxxxcollectionid",
"primaryOwnerDisplayName": "John Doe",
"owners": null,
"createdBy": "John Doe",
"updatedBy": "John Doe"
}Example 2: Permission-based Access Guardrail
Submit a POST request to the following endpoint: ${si}/access-governance/access-controls/${version}/accessGuardrails
{
"name": "group-membership-access-guardrail",
"description": "Ensures access control based on group membership permission",
"isDetectiveViolationCheckEnabled": false,
"tags": ["hasPermission"],
"rules": {
"items": [
{
"type": "DEFAULT",
"operator": "OR",
"conditions": {
"items": [
{
"type": "PERMISSION",
"basicCondition": {
"displayName": "sample_group",
"operator": "EQ",
"lhs": "id",
"rhs": [
"groups.OCI.xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxx"
],
"dataType": "STRING"
},
"childConditions": {
"items": []
},
"additionalAttributes": {
"connectedSystemId": "ocid1.tenancy.oc1..xxxxxxsystemid",
"connectedSystemLabel": "SampleSystem",
"connectedSystemType": "OCI",
"domainName": "Default",
"permissionTypeId": "etype.OCI.xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxx",
"permissionTypeLabel": "Group",
"permissionName": "groups"
}
}
]
}
}
]
},
"actionOnFailure": {
"actionType": "REVOKE_IMMEDIATELY",
"risk": "HIGH",
"revokeLaterAfterNumberOfDays": 0,
"shouldUserManagerBeNotified": false
},
"owners": [
{
"id": "ocid1.tenancy.oc1..xxxxxxownerid",
"name": "Alice",
"isPrimary": true
}
]
}Example of the Response Body
The following example shows response body in JSON format:
{
"id": "ocid1.tenancy.oc1..xxxxxxguardrailid",
"name": "group-membership-access-guardrail",
"description": "Ensures access control based on group membership permission",
"timeCreated": "2026-04-24T14:30:44.785Z",
"timeUpdated": "2026-04-24T14:30:44.785Z",
"lifecycleState": "ACTIVE",
"isDetectiveViolationCheckEnabled": false,
"tags": [
"hasPermission"
],
"rules": {
"items": [
{
"id": "rule-xxx-1",
"type": "DEFAULT",
"operator": "OR",
"conditions": {
"items": [
{
"type": "PERMISSION",
"basicCondition": {
"displayName": "sample_group",
"operator": "EQ",
"lhs": "id",
"rhs": [
"groups.OCI.xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxx"
],
"dataType": "STRING"
},
"childConditions": {
"items": []
},
"additionalAttributes": {
"connectedSystemId": "ocid1.tenancy.oc1..xxxxxxsystemid",
"connectedSystemLabel": "SampleSystem",
"connectedSystemType": "OCI",
"domainName": "Default",
"permissionTypeId": "etype.OCI.xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxx",
"permissionTypeLabel": "Group",
"permissionName": "groups"
}
}
]
}
}
]
},
"actionOnFailure": {
"actionType": "REVOKE_IMMEDIATELY",
"risk": "HIGH",
"revokeLaterAfterNumberOfDays": 0,
"shouldUserManagerBeNotified": false
},
"ownershipCollectionId": "ocid1.tenancy.oc1..xxxxxxcollectionid",
"primaryOwnerDisplayName": "Alice",
"owners": null,
"createdBy": "Alice",
"updatedBy": "Alice"
}