Skip to content

accesspackage-getapplicablepolicyrequirements.md

Latest commit

 

History

History
332 lines (270 loc) · 12.7 KB

accesspackage-getapplicablepolicyrequirements.md

File metadata and controls

332 lines (270 loc) · 12.7 KB
title accessPackage: getApplicablePolicyRequirements
description Allow callers to find requirements to request an assignment for a specific accessPackage.
ms.localizationpriority medium
author markwahl-msft
ms.subservice entra-id-governance
doc_type apiPageType
ms.date 04/05/2024

accessPackage: getApplicablePolicyRequirements

Namespace: microsoft.graph

[!INCLUDE beta-disclaimer]

In Microsoft Entra entitlement management, this action retrieves a list of accessPackageAssignmentRequestRequirements objects that the currently signed-in user can use to create an accessPackageAssignmentRequest. Each requirement object corresponds to an access package assignment policy that the currently signed-in user is allowed to request an assignment for.

[!INCLUDE national-cloud-support]

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

[!INCLUDE permissions-table]

[!INCLUDE rbac-entitlement-access-package-manager-write]

HTTP request

POST /identityGovernance/entitlementManagement/accessPackages/{id}/getApplicablePolicyRequirements

Function parameters

None.

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.

Request body

Don't supply a request body for this method if you wish to retrieve a list of access package requirements as in example 1. If you want to get policy requirements for user scope as in example 2, you must supply a request body.

Response

If successful, this method returns a 200 OK response code and an accessPackageAssignmentRequestRequirements collection in the response body, one object for each policy for which the user is an allowedRequestor. If there's a policy with no requirements, the accessPackageAssignmentRequestRequirements has false and null values. If there are no policies where the user is an allowedRequestor, an empty collection is returned instead.

Examples

Example 1: Retrieve a list of access package requirements to create an access package

Request

The following example shows a request.

HTTP

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/fb449cf8-3a59-4d86-bdfd-a1b7299681de/getApplicablePolicyRequirements

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 200 OK
Content-Type: application/json

{
    "value": [
        {
            "policyId": "d6322c23-04d6-eb11-b22b-c8d9d21f4e9a",
            "policyDisplayName": "Initial Policy",
            "policyDescription": "Initial Policy",
            "isApprovalRequired": false,
            "isApprovalRequiredForExtension": false,
            "isRequestorJustificationRequired": false,
            "questions": [
                {
                    "@odata.type": "#microsoft.graph.textInputQuestion",
                    "id": "0fd349e2-a3a7-4712-af08-660f29c12b90",
                    "isRequired": true,
                    "isAnswerEditable": null,
                    "sequence": 0,
                    "isSingleLineQuestion": true,
                    "text": {
                        "defaultText": "What is your display name",
                        "localizedTexts": []
                    }
                }
            ],
            "existingAnswers": [],
            "schedule": []
        }
    ]
}

Example 2: Get policy requirements for a given user scope

Request

The following example shows a request.

HTTP

POST https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages/b15419bb-5ffc-ea11-b207-c8d9d21f4e9a/getApplicablePolicyRequirements

{
        "subject": {
            "objectId": "5acd375c-8acb-45de-a958-fa0dd89259ad"
        }
    }

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

HTTP/1.1 200 OK
Content-Type: application/json

{
    "value": [
        {
            "policyId": "d6322c23-04d6-eb11-b22b-c8d9d21f4e9a",
            "policyDisplayName": "Initial Policy",
            "policyDescription": "Initial Policy",
            "isApprovalRequired": false,
            "isApprovalRequiredForExtension": false,
            "isRequestorJustificationRequired": false,
            "questions": [
                {
                    "@odata.type": "#microsoft.graph.textInputQuestion",
                    "id": "5a7f2a8f-b802-4438-bec6-09599bc43e13",
                    "isRequired": false,
                    "isAnswerEditable": true,
                    "sequence": 0,
                    "isSingleLineQuestion": true,
                    "text": {
                        "defaultText": "Enter your mail",
                        "localizedTexts": []
                    }
                }
            ],
            "existingAnswers": [
                {
                    "@odata.type": "#microsoft.graph.answerString",
                    "displayValue": "admin@contoso.com",
                    "value": "admin@contoso.com",
                    "answeredQuestion": {
                        "@odata.type": "#microsoft.graph.textInputQuestion",
                        "id": "5a7f2a8f-b802-4438-bec6-09599bc43e13",
                        "isRequired": false,
                        "isAnswerEditable": true,
                        "sequence": 0,
                        "isSingleLineQuestion": true,
                        "text": {
                            "defaultText": "Enter your mail",
                            "localizedTexts": []
                        }
                    }
                }
            ],
            "schedule": []
        }
    ]
}

Example 3: Get policy requirements for verifiable credential status requirements

Request

The following example shows a request.

POST /identityGovernance/entitlementManagement/accessPackages(‘b15419bb-5ffc-ea11-b207-c8d9d21f4e9a’)/getApplicablePolicyRequirements

Response

The following example shows the response if it is the first time credentials are requested and the requestor didn't scanned the QR code or clicked the URL.

HTTP/1.1 200 OK
Content-Type: application/json

{
  "value": [
        {
            "policyId": "a93f6641-bcba-ec11-9d14-001a7dda7113",
            "policyDisplayName": "VC Policy 1",
            "policyDescription": "VC Policy Description 1",
            "isApprovalRequiredForAdd": false,
            "isApprovalRequiredForUpdate": false,
            "isApprovalRequired": false,
            "isApprovalRequiredForExtension": false,
            "isCustomAssignmentScheduleAllowed": true,
            "allowCustomAssignmentSchedule": true,
            "isRequestorJustificationRequired": false,
            "schedule": {
                "startDateTime": null,
                "duration": "P365D",
                "stopDateTime": null,
                "expiration": {
                "endDateTime": null,
                "duration": "P365D",
                "type": "afterDuration"
                },
                "recurrence": null
            },
            "questions": [],
            "existingAnswers": [],
            "verifiableCredentialRequirementStatus": {
                "@odata.type": "#microsoft.graph.verifiableCredentialRequired",
                "expiryDateTime": "2022-05-10T23:32:47.8232759Z",
                "url": "openid://vc/?request_uri=https://beta.did.msidentity.com/v1.0/87654321-0000-0000-0000-000000000000/verifiablecredentials/request/e4ef27ca-eb8c-4b63-823b-3b95140eac11",
            }
        }
    ]
}

If the requestor has scanned the QR code or clicked the URL, the verifiableCredentialRequirementStatus property is in the following format.

"verifiableCredentialRequirementStatus": {
    "@odata.type": "#microsoft.graph.verifiableCredentialRetrieved",
    "expiryDateTime": "2022-05-10T23:32:47.8232759Z"
}

If the requestor presented valid credential, the verifiableCredentialRequirementStatus property is in the following format.

"verifiableCredentialRequirementStatus": {
    "@odata.type": "#microsoft.graph.verifiableCredentialVerified"
}