Oracle Access Governance REST APIs

Request analysis of Separation of Duties (async)

post

/access-governance/service-administration/20250331/orchestratedSystem/{orchestratedSystemId}/sod/analyze

Start analysis of Separation of Duties for an Orchestrated System. Request is asynchronous and returns a requestId which can be used to check status.

Request

Path Parameters

orchestratedSystemId(required): string

The unique id for an Orchestrated System. Available values can be found using the ListOrchestratedSystems operation.

Header Parameters

opc-request-id: string

The client request ID for tracing. The only valid characters for request IDs are letters, numbers, underscore, and dash.

Request details for performing Separation of Duties analysis.

Root Schema : SeparationOfDutiesAnalysisDetails

Type: object

Details for performing Separation of Duties analysis.

Show Source

accountData: object AccountData

Information about the user account.
orchestratedSystemIdentityId: string

The ID of the Identity on the Orchestrated System.
permissionAssignments(required): array permissionAssignments

Permissions to be analyzed along with the account.
requestedBy(required): string

The user who requested the analysis.

{
    "type":"object",
    "required":[
        "permissionAssignments",
        "requestedBy"
    ],
    "properties":{
        "orchestratedSystemIdentityId":{
            "type":"string",
            "description":"The ID of the Identity on the Orchestrated System."
        },
        "accountData":{
            "$ref":"#/definitions/AccountData"
        },
        "permissionAssignments":{
            "type":"array",
            "description":"Permissions to be analyzed along with the account.",
            "items":{
                "$ref":"#/definitions/AccountPermission"
            }
        },
        "requestedBy":{
            "type":"string",
            "description":"The user who requested the analysis."
        }
    },
    "description":"Details for performing Separation of Duties analysis."
}

Nested Schema : AccountData

Type: object

Information about the user account.

Show Source

attributes(required): array attributes

Account attributes.

{
    "type":"object",
    "required":[
        "attributes"
    ],
    "properties":{
        "attributes":{
            "type":"array",
            "description":"Account attributes.",
            "items":{
                "$ref":"#/definitions/Attribute"
            }
        }
    },
    "description":"Information about the user account."
}

Nested Schema : permissionAssignments

Type: array

Permissions to be analyzed along with the account.

Show Source

Array of: object AccountPermission

Permission to be scanned.

{
    "type":"array",
    "description":"Permissions to be analyzed along with the account.",
    "items":{
        "$ref":"#/definitions/AccountPermission"
    }
}

Nested Schema : attributes

Type: array

Account attributes.

Show Source

Array of: object Attribute

Attribute of the account.

{
    "type":"array",
    "description":"Account attributes.",
    "items":{
        "$ref":"#/definitions/Attribute"
    }
}

Nested Schema : Attribute

Type: object

Attribute of the account.

Show Source

action: string

Allowed Values: [ "ADD", "UPDATE" ]

Operation to be done on the attribute.
additionalAttributes: array additionalAttributes

Additional attributes.
attributes: array attributes

Attributes.
displayName: string

Display Name of the attribute.
name(required): string

Name of the attribute.
value: array value

Value of the attribute.

{
    "type":"object",
    "required":[
        "name"
    ],
    "properties":{
        "name":{
            "type":"string",
            "description":"Name of the attribute."
        },
        "displayName":{
            "type":"string",
            "description":"Display Name of the attribute."
        },
        "value":{
            "type":"array",
            "description":"Value of the attribute.",
            "items":{
                "type":"string"
            }
        },
        "action":{
            "type":"string",
            "description":"Operation to be done on the attribute.",
            "enum":[
                "ADD",
                "UPDATE"
            ],
            "x-obmcs-top-level-enum":"#/definitions/AttributeAction"
        },
        "additionalAttributes":{
            "type":"array",
            "description":"Additional attributes.",
            "items":{
                "$ref":"#/definitions/AdditionalAttribute"
            }
        },
        "attributes":{
            "type":"array",
            "description":"Attributes.",
            "items":{
                "$ref":"#/definitions/Attribute"
            }
        }
    },
    "description":"Attribute of the account."
}

Nested Schema : additionalAttributes

Type: array

Additional attributes.

Show Source

Array of: object AdditionalAttribute

Additional Attribute.

{
    "type":"array",
    "description":"Additional attributes.",
    "items":{
        "$ref":"#/definitions/AdditionalAttribute"
    }
}

Nested Schema : attributes

Type: array

Attributes.

Show Source

Array of: object Attribute

Attribute of the account.

{
    "type":"array",
    "description":"Attributes.",
    "items":{
        "$ref":"#/definitions/Attribute"
    }
}

Nested Schema : value

Type: array

Value of the attribute.

Show Source

Array of: string

{
    "type":"array",
    "description":"Value of the attribute.",
    "items":{
        "type":"string"
    }
}

Nested Schema : AdditionalAttribute

Type: object

Additional Attribute.

Show Source

name(required): string

Name of the attribute.
value(required): array value

Value of the attribute.

{
    "type":"object",
    "required":[
        "name",
        "value"
    ],
    "properties":{
        "name":{
            "type":"string",
            "description":"Name of the attribute."
        },
        "value":{
            "type":"array",
            "description":"Value of the attribute.",
            "items":{
                "type":"string"
            }
        }
    },
    "description":"Additional Attribute."
}

Nested Schema : value

Type: array

Value of the attribute.

Show Source

Array of: string

{
    "type":"array",
    "description":"Value of the attribute.",
    "items":{
        "type":"string"
    }
}

Nested Schema : AccountPermission

Type: object

Permission to be scanned.

Show Source

action(required): string

Allowed Values: [ "ADD", "UPDATE" ]

Action on the permission.
attributes(required): array attributes

Account attributes.
id(required): string

Permission ID.

{
    "type":"object",
    "required":[
        "action",
        "attributes",
        "id"
    ],
    "properties":{
        "id":{
            "type":"string",
            "description":"Permission ID."
        },
        "action":{
            "type":"string",
            "description":"Action on the permission.",
            "enum":[
                "ADD",
                "UPDATE"
            ],
            "x-obmcs-top-level-enum":"#/definitions/AttributeAction"
        },
        "attributes":{
            "type":"array",
            "description":"Account attributes.",
            "items":{
                "$ref":"#/definitions/Attribute"
            }
        }
    },
    "description":"Permission to be scanned."
}

Nested Schema : attributes

Type: array

Account attributes.

Show Source

Array of: object Attribute

Attribute of the account.

{
    "type":"array",
    "description":"Account attributes.",
    "items":{
        "$ref":"#/definitions/Attribute"
    }
}

Response

Supported Media Types

application/json

200 Response

Perform analysis request accepted for processing.

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : SeparationOfDutiesAnalysisResponseDetails

Type: object

Response of the perform analysis request.

Show Source

requestId(required): string

Unique perform analysis request identifier.
status(required): string

Request Status.

{
    "type":"object",
    "required":[
        "requestId",
        "status"
    ],
    "properties":{
        "requestId":{
            "type":"string",
            "description":"Unique perform analysis request identifier."
        },
        "status":{
            "type":"string",
            "description":"Request Status."
        }
    },
    "description":"Response of the perform analysis request."
}

400 Response

Bad Request

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

401 Response

Unauthorized

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

404 Response

Not Found

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

409 Response

Conflict

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

412 Response

Precondition failed

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

429 Response

Too Many Requests

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

500 Response

Internal Server Error

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

Default Response

Unknown Error

Headers

opc-request-id: string

Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID.

Root Schema : Error

Type: object

Error Information.

Show Source

code(required): string

A short error code that defines the error, meant for programmatic parsing.
message(required): string

A human-readable error string.

{
    "required":[
        "code",
        "message"
    ],
    "properties":{
        "code":{
            "type":"string",
            "description":"A short error code that defines the error, meant for programmatic parsing."
        },
        "message":{
            "type":"string",
            "description":"A human-readable error string."
        }
    },
    "description":"Error Information."
}

Examples

The following example shows how to analyze separation of duties. This is applicable for an Oracle Fusion Cloud Applications orchestrated system and the Oracle Fusion Cloud Risk Management and Compliance (RMC) integration must be enabled.

Run the following APIs before running this API:

GET /access-governance/service-administration/${versionID}/orchestratedSystems/{orchestratedSystemId}/permissions to fetch the permission
POST /access-governance/service-administration/${versionID}/orchestratedSystems/{orchestratedSystemId}/permissionAttributes
GET /access-governance/identities/20250331/identities to fetch identityTargetId to be used as orchestratedSystemIdentityId

cURL Request Example

curl -i -X POST \
   -H "Authorization:Bearer <your access token>" \
   -H "Content-Type:application/json" \
   -d \
'{
    "orchestratedSystemIdentityId": "targetId.account.ICF.xxx-efc9-4a9a-bae9-26eefecaadf1.3b3f2e1a4f60938fc313659602ac4402",
    "permissionAssignments": [
        {
            "id": "roles.ICF.306d8290-xxx-4a9a-bae9-26eefecaadf1.f8326a90ddb243bccb4761a01961d7be",
            "action": "ADD",
            "attributes": [
                {
                    "name": "roles",
                    "value": [
                        "ADB4281383Fxx8CB16BF17AA4FDECAA"
                        ],
                    "additionalAttributes": [
                    ]
                }
            ]
        }
    ],
    "requestedBy": "amel"
}' \
 '${service-instance-url}/access-governance/service-administration/${versionID}/orchestratedSystems/${orchestratedSystemId}/sod/analyze'

Example Request Payload

In your REST Client tool, submit the POST request

${service-instance-url}/access-governance/service-administration/${versionID}/orchestratedSystems/${orchestratedSystemId}/sod/analyze'

{
    "orchestratedSystemIdentityId": "targetId.account.ICF.xxx-efc9-4a9a-bae9-26eefecaadf1.3b3f2e1a4f60938fc313659602ac4402",
    "permissionAssignments": [
        {
            "id": "roles.ICF.306d8290-xxx-4a9a-bae9-26eefecaadf1.f8326a90ddb243bccb4761a01961d7be",
            "action": "ADD",
            "attributes": [
                {
                    "name": "roles",
                    "value": [
                        "ADB4281383Fxx88CB16BF17AA4FDECAA"
                        ],
                    "additionalAttributes": [
                    ]
                }
            ]
        }
    ],
    "requestedBy": "amel"
}

Example of the Response Code

You'll receive 200 OK response along with the following response body:

{
    "requestId": "c87b487de125418ea73150bd62e5f2c7",
    "status": "InProgress"
}

Use the requestID to check the /access-governance/service-administration/20250331/orchestratedSystems/{orchestratedSystemId}/sod/status.