Skip to content

OKTA-926630 - Update role assignment concept #5422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

OKTA-926630 - Update role assignment concept #5422

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2cd0d77
Removed static list of roles and referenced OAS3 reference
brianduffield-okta May 7, 2025
9e30311
One minor acrolinx update
brianduffield-okta May 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 4 additions & 26 deletions packages/@okta/vuepress-site/docs/concepts/role-assignment/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,32 +10,10 @@ This page discusses the concepts of role assignment through APIs. See [Custom ad

## Standard role assignment

### Standard role types
See the following references for a list of standard role types:

The following role types are provided and supported:

| Role type | Label | Optional targets |
| :-------------------------------------- | :---------------------------------- | :------------------------------------ |
| `API_ACCESS_MANAGEMENT_ADMIN` | API Access Management administrator | |
| `APP_ADMIN` | Application administrator | Apps |
| `GROUP_MEMBERSHIP_ADMIN` | Group membership administrator | [Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/) |
| `HELP_DESK_ADMIN` | Help desk administrator | [Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/) |
| `MOBILE_ADMIN` | Mobile administrator | |
| `ORG_ADMIN` | Organization administrator | |
| `READ_ONLY_ADMIN` | Read-only administrator | |
| `REPORT_ADMIN` | Report administrator | |
| `SUPER_ADMIN` | Super administrator | |
| `USER_ADMIN` | Group administrator | [Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/) |

### IAM-based standard role Types

Okta also supports the following IAM-based standard roles:
| Role type | Label | Permissions |
| :--------------------------------------------------------- | :---------------------------------- | :-------------------------------------------- |
| `ACCESS_CERTIFICATIONS_ADMIN`| Access certifications administrator | `okta.governance.accessCertifications.manage` |
| `ACCESS_REQUESTS_ADMIN` | Access requests administrator | `okta.governance.accessRequests.manage` |

You can assign IAM-based standard roles using assignment operations for [standard](#standard-role-assignment-steps) or [custom](#custom-role-assignment) roles. These roles are immutable, and you can't update or delete them.
* [Standard role types](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles)
* [IAM-based standard role types](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles)

### Standard Role Assignment steps

Expand Down Expand Up @@ -115,7 +93,7 @@ The partition is specific to your Okta environment. The following are the suppor

###### tenantId

The identifier for the tenant that is using the service. This is typically your [org ID]( https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingGeneral/#tag/OrgSettingGeneral/operation/getOrgSettings!c=200&path=id&t=response).
The identifier for the tenant that’s using the service. This is typically your [org ID]( https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingGeneral/#tag/OrgSettingGeneral/operation/getOrgSettings!c=200&path=id&t=response).

###### objectType

Expand Down