> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-nhi-visibility-draft.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Get Effective Session Policy > Returns the single effective session policy for a user and why it applies: the assigned policy with the highest priority, else the tenant default, else none. Read-only and diagnostic: it reflects current assignment state rather than the resolver's cached resolution. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples get /api/v1/users/{user_id}/effective-session-policy openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/users/{user_id}/effective-session-policy: get: tags: - Session Policy summary: Get Effective Session Policy description: >- Returns the single effective session policy for a user and why it applies: the assigned policy with the highest priority, else the tenant default, else none. Read-only and diagnostic: it reflects current assignment state rather than the resolver's cached resolution. operationId: c1.api.session_policy.v1.SessionPolicyService.GetEffectiveSessionPolicy parameters: - in: path name: user_id required: true schema: description: The user whose effective session policy to resolve. type: string responses: '200': content: application/json: schema: $ref: >- #/components/schemas/c1.api.session_policy.v1.SessionPolicyServiceGetEffectiveSessionPolicyResponse description: >- SessionPolicyServiceGetEffectiveSessionPolicyResponse carries the effective policy and why it applies. components: schemas: c1.api.session_policy.v1.SessionPolicyServiceGetEffectiveSessionPolicyResponse: description: >- SessionPolicyServiceGetEffectiveSessionPolicyResponse carries the effective policy and why it applies. properties: group: oneOf: - $ref: '#/components/schemas/c1.api.app.v1.AppEntitlement' - type: 'null' sessionPolicy: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.SessionPolicy' - type: 'null' source: description: Why the policy applies. enum: - EFFECTIVE_SESSION_POLICY_SOURCE_UNSPECIFIED - EFFECTIVE_SESSION_POLICY_SOURCE_DIRECT - EFFECTIVE_SESSION_POLICY_SOURCE_GROUP - EFFECTIVE_SESSION_POLICY_SOURCE_TENANT_DEFAULT - EFFECTIVE_SESSION_POLICY_SOURCE_TENANT_DEFAULT_NONE type: string x-speakeasy-unknown-values: allow title: Session Policy Service Get Effective Session Policy Response type: object x-speakeasy-name-override: SessionPolicyServiceGetEffectiveSessionPolicyResponse c1.api.app.v1.AppEntitlement: description: > The app entitlement represents one permission in a downstream App (SAAS) that can be granted. For example, GitHub Read vs GitHub Write. This message contains a oneof named max_grant_duration. Only a single field of the following list may be set at a time: - durationUnset - durationGrant properties: alias: description: >- The alias of the app entitlement used by Cone. Also exact-match queryable. type: string annotations: additionalProperties: type: string description: |- Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars URL-safe ASCII; total serialized ≤ 4096 bytes. Keys matching ^c1/ are reserved. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. type: object x-speakeasy-terraform-plan-modifier: imports: - >- github.com/conductorone/terraform-provider-conductorone/internal/annotations schemaDefinition: annotations.PlanModifier() appId: description: The ID of the app that is associated with the app entitlement. type: string appResourceId: description: >- The ID of the app resource that is associated with the app entitlement type: string appResourceTypeId: description: >- The ID of the app resource type that is associated with the app entitlement type: string certifyPolicyId: description: >- The ID of the policy that will be used for certify tickets related to the app entitlement. type: string complianceFrameworkValueIds: description: >- The IDs of different compliance frameworks associated with this app entitlement ex (SOX, HIPAA, PCI, etc.) items: type: string type: - array - 'null' createdAt: format: date-time readOnly: true type: - string - 'null' defaultValuesApplied: description: >- Flag to indicate if app-level access request defaults have been applied to the entitlement type: boolean deletedAt: format: date-time readOnly: true type: - string - 'null' deprovisionerPolicy: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ProvisionPolicy' - type: 'null' description: description: The description of the app entitlement. type: string displayName: description: The display name of the app entitlement. type: string durationGrant: format: duration type: - string - 'null' durationUnset: type: - object - 'null' emergencyGrantEnabled: description: >- This enables tasks to be created in an emergency and use a selected emergency access policy. type: boolean emergencyGrantPolicyId: description: >- The ID of the policy that will be used for emergency access grant tasks. type: string externalId: description: >- The upstream product's native external ID for this entitlement (e.g. an Okta group ID). Populated from the connector's external ID during sync. readOnly: true type: string grantCount: description: The amount of grants open for this entitlement format: int64 readOnly: true type: string grantPolicyId: description: >- The ID of the policy that will be used for grant tickets related to the app entitlement. type: string id: description: The unique ID for the App Entitlement. readOnly: true type: string isAutomationEnabled: description: >- Flag to indicate whether automation (for adding users to entitlement based on rules) has been enabled. readOnly: true type: boolean isManuallyManaged: description: Flag to indicate if the app entitlement is manually managed. type: boolean matchBatonId: description: >- An identifier used to match this entitlement to a connector-synced entitlement during sync. type: string overrideAccessRequestsDefaults: description: >- Flag to indicate if the app-level access request settings have been overridden for the entitlement type: boolean provisionerPolicy: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ProvisionPolicy' - type: 'null' purpose: description: >- The purpose of this entitlement (e.g., assignment, permission, ownership). enum: - APP_ENTITLEMENT_PURPOSE_VALUE_UNSPECIFIED - APP_ENTITLEMENT_PURPOSE_VALUE_ASSIGNMENT - APP_ENTITLEMENT_PURPOSE_VALUE_PERMISSION - APP_ENTITLEMENT_PURPOSE_VALUE_OWNERSHIP type: string x-speakeasy-unknown-values: allow requestSchemaId: description: The ID of the request schema associated with this app entitlement. type: string revokePolicyId: description: >- The ID of the policy that will be used for revoke tickets related to the app entitlement type: string riskLevelValueId: description: The ID of the risk level assigned to this entitlement. type: string slug: description: >- The slug is displayed as an oval next to the name in the frontend of C1, it tells you what permission the entitlement grants. See https://www.conductorone.com/docs/product/admin/entitlements/ type: string sourceConnectorIds: additionalProperties: type: string description: Map to tell us which connector the entitlement came from. type: object systemBuiltin: description: This field indicates if this is a system builtin entitlement. readOnly: true type: boolean updatedAt: format: date-time readOnly: true type: - string - 'null' userEditedMask: type: - string - 'null' title: App Entitlement type: object x-speakeasy-entity: Custom App Entitlement x-speakeasy-name-override: AppEntitlement c1.api.session_policy.v1.SessionPolicy: description: >- SessionPolicy defines session lifetime and continuous-evaluation behavior. properties: accessTokenTtlSeconds: description: How long an access token is valid, in seconds. format: int32 type: integer continuousDefaultOutcome: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.PolicyOutcome' - type: 'null' continuousRules: description: >- The continuous-evaluation rule cascade, re-checked on every request and on inbound shared-signals events. items: $ref: '#/components/schemas/c1.api.session_policy.v1.PolicyRule' type: - array - 'null' createdAt: format: date-time readOnly: true type: - string - 'null' credentialDurations: description: Per-credential-type lifetime overrides. items: $ref: >- #/components/schemas/c1.api.session_policy.v1.PerCredentialDuration type: - array - 'null' deletedAt: format: date-time readOnly: true type: - string - 'null' displayName: description: A human-readable name for the policy. type: string id: description: Unique identifier for the policy. readOnly: true type: string idleTimeoutSeconds: description: How long a session may be idle before it ends, in seconds. format: int32 type: integer isBuiltin: description: >- True for built-in policies provided by ConductorOne. Built-in policies cannot be edited or deleted. readOnly: true type: boolean maxSessionDurationSeconds: description: The maximum total lifetime of a session, in seconds. format: int32 type: integer persistence: description: Whether sessions may persist across browser restarts. enum: - PERSISTENCE_MODE_UNSPECIFIED - PERSISTENCE_MODE_ALLOW_USER_CHOICE - PERSISTENCE_MODE_ALWAYS_PERSIST - PERSISTENCE_MODE_SESSION_ONLY type: string x-speakeasy-unknown-values: allow priority: description: >- When a user matches more than one policy, the policy with the highest priority applies. format: int32 type: integer refreshRotationWindowSeconds: description: >- Grace window after rotation during which the previous refresh token is still accepted, in seconds (covers in-flight client retries). format: int32 type: integer refreshTokenTtlSeconds: description: How long a refresh token is valid, in seconds. format: int32 type: integer rotateRefreshOnUse: description: Whether to issue a new refresh token each time one is used. type: boolean ssfReceive: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.SSFReceiverConfig' - type: 'null' ssfTransmit: oneOf: - $ref: >- #/components/schemas/c1.api.session_policy.v1.SSFTransmitterConfig - type: 'null' updatedAt: format: date-time readOnly: true type: - string - 'null' title: Session Policy type: object x-speakeasy-entity: SessionPolicy x-speakeasy-name-override: SessionPolicy c1.api.policy.v1.ProvisionPolicy: description: > ProvisionPolicy is a oneOf that indicates how a provision step should be processed. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - connector - manual - delegated - webhook - multiStep - externalTicket - unconfigured - action - devicePlacement properties: action: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ActionProvision' - type: 'null' connector: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ConnectorProvision' - type: 'null' delegated: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.DelegatedProvision' - type: 'null' devicePlacement: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.DevicePlacementProvision' - type: 'null' externalTicket: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ExternalTicketProvision' - type: 'null' manual: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ManualProvision' - type: 'null' multiStep: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.MultiStep' - type: 'null' unconfigured: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.UnconfiguredProvision' - type: 'null' webhook: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.WebhookProvision' - type: 'null' title: Provision Policy type: object x-speakeasy-name-override: ProvisionPolicy c1.api.session_policy.v1.PolicyOutcome: description: > PolicyOutcome is the effect of a matched rule. Exactly one kind is set. For session continuous-evaluation, the meaningful kinds are Allow (continue), Deny (terminate), and StepUpRequired. This message contains a oneof named kind. Only a single field of the following list may be set at a time: - allow - deny - stepUpRequired - challengeRequired - enrollmentRequired properties: allow: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.Allow' - type: 'null' challengeRequired: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.ChallengeRequired' - type: 'null' deny: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.Deny' - type: 'null' enrollmentRequired: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.EnrollmentRequired' - type: 'null' stepUpRequired: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.StepUpRequired' - type: 'null' title: Policy Outcome type: object x-speakeasy-name-override: SessionPolicyPolicyOutcome c1.api.session_policy.v1.PolicyRule: description: >- PolicyRule is one rung of the ordered continuous-evaluation cascade. Rules are evaluated top to bottom on every request; the first enforced rule whose condition matches supplies the outcome. properties: description: description: The description field. type: string id: description: The id field. type: string matchCel: description: The matchCel field. type: string mode: description: The mode field. enum: - POLICY_RULE_MODE_UNSPECIFIED - POLICY_RULE_MODE_ENFORCE - POLICY_RULE_MODE_OBSERVE - POLICY_RULE_MODE_DISABLED type: string x-speakeasy-unknown-values: allow outcome: oneOf: - $ref: '#/components/schemas/c1.api.session_policy.v1.PolicyOutcome' - type: 'null' title: Policy Rule type: object x-speakeasy-name-override: SessionPolicyPolicyRule c1.api.session_policy.v1.PerCredentialDuration: description: >- PerCredentialDuration overrides session lifetimes for sessions established with a particular credential type — stronger credentials can earn longer sessions. properties: accessTokenTtlSeconds: description: Access-token lifetime for this credential type, in seconds. format: int32 type: integer credentialType: description: The credentialType field. enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSKEY - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_TOTP - CREDENTIAL_TYPE_EMAIL_OTP - CREDENTIAL_TYPE_RECOVERY_CODE - CREDENTIAL_TYPE_DELEGATED_GOOGLE - CREDENTIAL_TYPE_DELEGATED_MICROSOFT - CREDENTIAL_TYPE_UPSTREAM_IDP type: string x-speakeasy-unknown-values: allow maxSessionDurationSeconds: description: Maximum total session duration for this credential type, in seconds. format: int32 type: integer title: Per Credential Duration type: object x-speakeasy-name-override: PerCredentialDuration c1.api.session_policy.v1.SSFReceiverConfig: description: >- SSFReceiverConfig selects which inbound shared-signals streams this session trusts. Each stream's issuer, keys, expected audience, and per-event actions are configured on the stream itself; this policy just lists the stream IDs. properties: enabled: description: >- Whether inbound shared-signals consumption is enabled for this policy. type: boolean ssfReceiverStreamIds: description: The inbound stream IDs this policy trusts. items: type: string type: - array - 'null' title: Ssf Receiver Config type: object x-speakeasy-name-override: SSFReceiverConfig c1.api.session_policy.v1.SSFTransmitterConfig: description: |- SSFTransmitterConfig selects which outbound shared-signals streams this session emits security events to. Each stream's delivery endpoint, authentication, and per-event allowlist are configured on the stream itself; this policy just lists the stream IDs and the event types to emit. properties: enabled: description: Whether outbound shared-signals emission is enabled for this policy. type: boolean eventTypes: description: The shared-signals event types to emit at the policy level. items: type: string type: - array - 'null' ssfTransmitterStreamIds: description: The outbound stream IDs this policy emits to. items: type: string type: - array - 'null' title: Ssf Transmitter Config type: object x-speakeasy-name-override: SSFTransmitterConfig c1.api.policy.v1.ActionProvision: description: >- This provision step indicates that account lifecycle action should be called to provision this entitlement. properties: actionName: description: The actionName field. type: string appId: description: The appId field. type: string connectorId: description: The connectorId field. type: string displayName: description: The displayName field. type: string title: Action Provision type: object x-speakeasy-name-override: ActionProvision c1.api.policy.v1.ConnectorProvision: description: > Indicates that a connector should perform the provisioning. This object has no fields. This message contains a oneof named provision_type. Only a single field of the following list may be set at a time: - defaultBehavior - account - deleteAccount properties: account: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.AccountProvision - type: 'null' defaultBehavior: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.DefaultBehavior - type: 'null' deleteAccount: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.DeleteAccount - type: 'null' title: Connector Provision type: object x-speakeasy-name-override: ConnectorProvision c1.api.policy.v1.DelegatedProvision: description: >- This provision step indicates that we should delegate provisioning to the configuration of another app entitlement. This app entitlement does not have to be one from the same app, but MUST be configured as a proxy binding leading into this entitlement. properties: appId: description: The AppID of the entitlement to delegate provisioning to. type: string entitlementId: description: The ID of the entitlement we are delegating provisioning to. type: string implicit: description: >- If true, a binding will be automatically created from the entitlement of the parent app. type: boolean title: Delegated Provision type: object x-speakeasy-name-override: DelegatedProvision c1.api.policy.v1.DevicePlacementProvision: description: >- This provision step is fulfilled by a Latchkey member device producing an MLS Welcome for the recipient. It has no assignee and no instructions because the step is not human-actionable. properties: vaultBoundaryId: description: The vaultBoundaryId field. type: string title: Device Placement Provision type: object x-speakeasy-name-override: DevicePlacementProvision c1.api.policy.v1.ExternalTicketProvision: description: >- This provision step indicates that we should check an external ticket to provision this entitlement properties: appId: description: The appId field. type: string connectorId: description: The connectorId field. type: string externalTicketProvisionerConfigId: description: The externalTicketProvisionerConfigId field. type: string instructions: description: >- This field indicates a text body of instructions for the provisioner to indicate. type: string title: External Ticket Provision type: object x-speakeasy-name-override: ExternalTicketProvision c1.api.policy.v1.ManualProvision: description: >- Manual provisioning indicates that a human must intervene for the provisioning of this step. properties: assignee: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ProvisionerAssignment' - type: 'null' instructions: description: >- This field indicates a text body of instructions for the provisioner to indicate. type: string userIds: description: |- An array of users that are required to provision during this step. Deprecated: Use assignee field instead for dynamic provisioner assignment. items: type: string type: - array - 'null' title: Manual Provision type: object x-speakeasy-name-override: ManualProvision c1.api.policy.v1.MultiStep: description: >- MultiStep indicates that this provision step has multiple steps to process. properties: provisionSteps: description: The array of provision steps to process. items: $ref: '#/components/schemas/c1.api.policy.v1.ProvisionPolicy' type: - array - 'null' title: Multi Step type: object x-speakeasy-name-override: MultiStep c1.api.policy.v1.UnconfiguredProvision: description: The UnconfiguredProvision message. title: Unconfigured Provision type: object x-speakeasy-name-override: UnconfiguredProvision c1.api.policy.v1.WebhookProvision: description: >- This provision step indicates that a webhook should be called to provision this entitlement. properties: webhookId: description: The ID of the webhook to call for provisioning. type: string title: Webhook Provision type: object x-speakeasy-name-override: WebhookProvision c1.api.session_policy.v1.Allow: description: Allow continues the session. properties: floorLevel: description: The minimum assurance level that satisfies this rule. enum: - AUTH_LEVEL_UNSPECIFIED - AUTH_LEVEL_NONE - AUTH_LEVEL_SINGLE_FACTOR - AUTH_LEVEL_MULTI_FACTOR - AUTH_LEVEL_PHR - AUTH_LEVEL_PHRH type: string x-speakeasy-unknown-values: allow title: Allow type: object x-speakeasy-name-override: SessionPolicyAllow c1.api.session_policy.v1.ChallengeRequired: description: ChallengeRequired asks for an additional factor. properties: types: description: The types field. items: enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSKEY - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_TOTP - CREDENTIAL_TYPE_EMAIL_OTP - CREDENTIAL_TYPE_RECOVERY_CODE - CREDENTIAL_TYPE_DELEGATED_GOOGLE - CREDENTIAL_TYPE_DELEGATED_MICROSOFT - CREDENTIAL_TYPE_UPSTREAM_IDP type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: Challenge Required type: object x-speakeasy-name-override: SessionPolicyChallengeRequired c1.api.session_policy.v1.Deny: description: Deny terminates the session. properties: reasonAdmin: description: Reason shown in admin-only audit. type: string reasonUser: description: Reason safe to show the end user. type: string title: Deny type: object x-speakeasy-name-override: SessionPolicyDeny c1.api.session_policy.v1.EnrollmentRequired: description: >- EnrollmentRequired tells the user to enroll a credential before continuing. properties: credentialTypes: description: The credentialTypes field. items: enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSKEY - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_TOTP - CREDENTIAL_TYPE_EMAIL_OTP - CREDENTIAL_TYPE_RECOVERY_CODE - CREDENTIAL_TYPE_DELEGATED_GOOGLE - CREDENTIAL_TYPE_DELEGATED_MICROSOFT - CREDENTIAL_TYPE_UPSTREAM_IDP type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: Enrollment Required type: object x-speakeasy-name-override: SessionPolicyEnrollmentRequired c1.api.session_policy.v1.StepUpRequired: description: >- StepUpRequired demands a stronger re-authentication before the session may continue. properties: level: description: The level field. enum: - AUTH_LEVEL_UNSPECIFIED - AUTH_LEVEL_NONE - AUTH_LEVEL_SINGLE_FACTOR - AUTH_LEVEL_MULTI_FACTOR - AUTH_LEVEL_PHR - AUTH_LEVEL_PHRH type: string x-speakeasy-unknown-values: allow maxAgeSeconds: description: How fresh the step-up must be, in seconds. format: int32 type: integer types: description: The types field. items: enum: - CREDENTIAL_TYPE_UNSPECIFIED - CREDENTIAL_TYPE_PASSKEY - CREDENTIAL_TYPE_PASSWORD - CREDENTIAL_TYPE_TOTP - CREDENTIAL_TYPE_EMAIL_OTP - CREDENTIAL_TYPE_RECOVERY_CODE - CREDENTIAL_TYPE_DELEGATED_GOOGLE - CREDENTIAL_TYPE_DELEGATED_MICROSOFT - CREDENTIAL_TYPE_UPSTREAM_IDP type: string x-speakeasy-unknown-values: allow type: - array - 'null' title: Step Up Required type: object x-speakeasy-name-override: SessionPolicyStepUpRequired c1.api.policy.v1.ConnectorProvision.AccountProvision: description: > The AccountProvision message. This message contains a oneof named storage_type. Only a single field of the following list may be set at a time: - saveToVault - doNotSave properties: config: additionalProperties: true type: - object - 'null' connectorId: description: The connectorId field. type: string doNotSave: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.DoNotSave - type: 'null' saveToVault: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.ConnectorProvision.SaveToVault - type: 'null' schemaId: description: The schemaId field. type: string title: Account Provision type: object x-speakeasy-name-override: AccountProvision c1.api.policy.v1.ConnectorProvision.DefaultBehavior: description: The DefaultBehavior message. properties: connectorId: description: >- this checks if the entitlement is enabled by provisioning in a specific connector this can happen automatically and doesn't need any extra info type: string title: Default Behavior type: object x-speakeasy-name-override: DefaultBehavior c1.api.policy.v1.ConnectorProvision.DeleteAccount: description: The DeleteAccount message. properties: connectorId: description: The connectorId field. type: string title: Delete Account type: object x-speakeasy-name-override: DeleteAccount c1.api.policy.v1.ProvisionerAssignment: description: > ProvisionerAssignment defines how a provisioner is dynamically assigned. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - appOwners - group - manager - expression - entitlementOwners properties: appOwners: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.AppOwnerProvisioner' - type: 'null' entitlementOwners: oneOf: - $ref: >- #/components/schemas/c1.api.policy.v1.EntitlementOwnerProvisioner - type: 'null' expression: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ExpressionProvisioner' - type: 'null' group: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.GroupProvisioner' - type: 'null' manager: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.ManagerProvisioner' - type: 'null' users: oneOf: - $ref: '#/components/schemas/c1.api.policy.v1.UserProvisioner' - type: 'null' title: Provisioner Assignment type: object x-speakeasy-name-override: ProvisionerAssignment c1.api.policy.v1.ConnectorProvision.DoNotSave: description: The DoNotSave message. title: Do Not Save type: object x-speakeasy-name-override: DoNotSave c1.api.policy.v1.ConnectorProvision.SaveToVault: description: The SaveToVault message. properties: vaultIds: description: The vaultIds field. items: type: string type: - array - 'null' title: Save To Vault type: object x-speakeasy-name-override: SaveToVault c1.api.policy.v1.AppOwnerProvisioner: description: AppOwnerProvisioner resolves to app owners. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: boolean fallbackUserIds: description: Fallback user IDs if no app owners are found. items: type: string type: - array - 'null' title: App Owner Provisioner type: object x-speakeasy-name-override: AppOwnerProvisioner c1.api.policy.v1.EntitlementOwnerProvisioner: description: EntitlementOwnerProvisioner resolves to entitlement owners. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: boolean fallbackUserIds: description: Fallback user IDs if no entitlement owners are found. items: type: string type: - array - 'null' title: Entitlement Owner Provisioner type: object x-speakeasy-name-override: EntitlementOwnerProvisioner c1.api.policy.v1.ExpressionProvisioner: description: >- ExpressionProvisioner evaluates CEL expressions to determine provisioners. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: boolean expressions: description: The CEL expressions to evaluate. items: type: string type: - array - 'null' fallbackUserIds: description: Fallback user IDs if expression evaluation yields no users. items: type: string type: - array - 'null' title: Expression Provisioner type: object x-speakeasy-name-override: ExpressionProvisioner c1.api.policy.v1.GroupProvisioner: description: GroupProvisioner resolves to members of a specific group. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: boolean appGroupId: description: The app group ID (entitlement ID). type: string appId: description: The app ID containing the group. type: string fallbackUserIds: description: Fallback user IDs if no group members are found. items: type: string type: - array - 'null' title: Group Provisioner type: object x-speakeasy-name-override: GroupProvisioner c1.api.policy.v1.ManagerProvisioner: description: ManagerProvisioner resolves to the user's manager. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: boolean fallbackUserIds: description: Fallback user IDs if no manager is found. items: type: string type: - array - 'null' title: Manager Provisioner type: object x-speakeasy-name-override: ManagerProvisioner c1.api.policy.v1.UserProvisioner: description: UserProvisioner assigns specific users as provisioners. properties: allowReassignment: description: Whether the provisioner can reassign the task. type: boolean userIds: description: The user IDs to assign as provisioners. items: type: string type: - array - 'null' title: User Provisioner type: object x-speakeasy-name-override: UserProvisioner securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````