addGroupMember
Add an identity to a group
addGroupToGroup
Nest one group inside another
allowDenyReview
No description
applyIntegrationValueUpdate
Takes the connector's current value for one pending field: overwrites the integration's copy and re-derives its entity schemas.
approveRequestPolicyException
No description
archiveReviewCampaignDefinition
Archive (soft-delete) a definition — allowed any time (it's a template). Minted instances keep their link to it and stay queryable.
archiveReviewCampaign
Archive (soft-delete) a FINISHED instance (COMPLETED/CANCELLED/FAILED) out of the lists. 409 on a live campaign — cancel it first.
assignRole
No description
assignSetupOwner
No description
bindExternalAccount
Bind a waiting grants-only assignment to one of its identity's linked accounts (the ambiguity picker).
cancelImportJob
No description
cancelPolicyBreaker
No description
cancelPolicyWave
No description
cancelProvisioningOperation
No description
cancelRequest
No description
cancelReviewCampaign
Cancel a campaign. DRAFT/FAILED (with no live items)
cancelSyncRun
No description
cancelWaitingOperation
No description
changeMyLinkedPasswords
Without password sign-in: set the password of every password-linked account.
changeMyLoginEmail
No description
changeMyPassword
Change your Owlie password. Password-linked accounts follow. Other sessions are signed out.
claimTicket
No description
confirmLapseReview
No description
confirmPolicyWave
No description
confirmSlackIdentityLink
No description
confirmSodConstraintActivation
No description
confirmUpload
No description
createAccountSyncJob
No description
createAPIKey
No description
createBulkJob
No description
createCustomActionDefinition
No description
createCustomConnectorFork
Creates a tenant connector that stacks on another connector's version (a fork) with an empty
createCustomConnector
A key used by another connector in the tenant, live or deleted (keys are never reused), fails with
createCustomIdentityAttribute
No description
createDerivedStateAttribute
No description
createDerivedStateRule
No description
createEntitySyncJob
No description
createFunction
No description
createGateway
No description
createGroup
Create a new group
createIdentity
No description
createIdpClient
No description
createImportJob
No description
createLifecycleStep
No description
createPolicy
No description
createProvisioningOperation
No description
createReaction
No description
createRelationshipSyncJob
No description
createRequestComment
No description
createRequest
No description
createResource
Create a new resource
createReviewCampaignDefinition
No description
createReviewCampaign
No description
createReviewItem
Create an ad-hoc certification or holder attestation for a single resource grant. kind defaults to CERTIFICATION. Optionally override the policy inline with a partial review policy — that ALSO requires review.policy.manage. Returns the CREATED stub; the engine processes it asynchronously.
createSodConstraint
No description
createSyncJobsFromManifest
No description
customConnectorImport
Validation failures come back as ok=false with issues and write nothing. A stale
deleteCustomActionDefinition
No description
deleteCustomConnector
No description
deleteCustomIdentityAttribute
No description
deleteDerivedStateAttribute
No description
deleteDerivedStateRule
No description
deleteFunction
No description
deleteGroup
Delete a group
deleteIdpClient
No description
deleteIntegration
No description
deletePolicy
No description
deleteReaction
No description
deleteRequestComment
No description
deleteResource
Delete a resource (soft delete)
deleteSodConstraint
No description
deleteSyncJob
No description
disablePolicy
No description
disableSodConstraint
No description
dismissInAppNotification
No description
dismissSetupStep
No description
duplicateCustomConnector
Creates a connector whose draft is a copy of this connector's current draft (manifest and files as
editPolicyDraft
No description
editSodConstraint
No description
_empty
No description
enablePolicy
No description
enableSodConstraint
No description
enqueueAssignedResourceReconcile
No description
executeCustomAction
No description
exportCampaignEvidence
Request an async evidence export of the campaign (review.campaign.manage). Returns the PENDING record immediately; a background job streams the NDJSON to storage and notifies the requester. 409 while another export is in flight or for DRAFT/GENERATING campaigns.
extendRequestResourceDueDate
No description
extendReviewItemDueDate
Extend the current stage's due date (admin operator action; requires review.item.create). OPEN items only; newDueDate must be in the future. Rewrites the stage's PENDING due dates, recomputes expiresat (deliberately OVERRIDING the campaign dueat ceiling), moves the escalation and expiry points with the new due date, and records DUEDATEEXTENDED. Returns the updated admin item.
extendSupport
No description
finalizeIntegrationDeletion
Completes a deleting integration once its revokethendelete grants have drained. force finalizes even with grants still outstanding (they are left unmanaged).
flattenCustomConnectorFork
Turns the fork's draft into an ordinary draft holding its current content; it stops following the
generateCampaignReviews
Launch generation of a DRAFT or FAILED campaign (409 otherwise). Returns at once with the campaign GENERATING; its review items are generated and queued in the background, and the campaign becomes ACTIVE when generation finishes.
greenLightDenyReview
No description
ignoreIntegrationValueUpdate
Keeps the integration's own value for one pending field and acknowledges the connector's. Returns what is still pending.
installIntegration
No description
inviteAdmin
No description
invokeConnectorOperation
No description
keepLapseReview
No description
markAllInAppNotificationsRead
No description
markInAppNotificationsRead
No description
markReviewItemSourceAddressed
Record write-once evidence that a re-applicable grant's source (policy/workflow/scheduled) was addressed (review.remediation.execute). Unblocks REVOKE_BLOCKED decisions and releases held remediation. The note is required (1..2000 chars). Durable grants → 400; re-marking → 409. Returns the updated admin item.
previewPolicyActivation
No description
previewSodConstraintActivation
No description
processCreatedReviewItems
Operator escape hatch: enqueue all tenant review items still in CREATED so the review engine can materialize them. Does not touch OPEN or terminal items.
processRequest
No description
publishCustomConnectorVersion
Publishes the draft at expectedRevision, the draft_revision the caller reviewed. A draft that moved
publishFunction
No description
purgeIntegration
Permanently removes a never-provisioned integration and its linked resources (irreversible). Refuses if any linked resource has provisioning history.
reassignApprovalStep
No description
rebaseCustomConnectorFork
Moves the fork's draft onto another published version of its base connector (a new Owlie major).
reconcileIntegrationManifest
No description
recordReviewDecision
Record a reviewer's decision on a step. Returns a reviewer-safe ReviewDecisionResult ({ reviewItemId, ok, status, message }) — NOT the full ReviewItem, so the policy, lineage, events and other reviewers' steps are never selectable on the decide response.
recordReviewDecisions
Record many reviewer decisions in one call. Authenticated-only; each item is authorized on its own. Returns a per-item result; an item the actor cannot decide returns FORBIDDEN without failing the batch.
reissueGatewayEnrollmentToken
No description
releaseLoginEmail
No description
relinkIdentityAccounts
No description
remediateReviewItem
Operator 'Remediate' action (review.remediation.execute). Submits a NEEDSREMEDIATION item's revoke as a provisioning operation, or retries a FAILED one on the same operation — executed in the background. Held-on-source, INPROGRESS, COMPLETED, NOT_REQUIRED, and disabled-mode grants → 409. Returns the refreshed admin item.
remind
No description
removeGroupFromGroup
Remove a nested group relationship
removeGroupMember
Remove an identity from a group
removeIdentity
No description
removeSsoLink
No description
reorderDerivedStateRules
No description
repreviewPolicyWave
No description
requestUpload
No description
resolveAlert
No description
resolveCustomConnectorForkConflicts
Settles upstream conflicts and reverts fork changes to the base on the fork's draft at
resolveSyncPendingAdoption
Approve (adopt) or reject (flag) a parked adopt-with-review item.
resolveSyncUnmatchedAccount
Resolve one unmatched account through the sync domain's assignment or governance workflow.
restoreSetupStep
No description
resumePolicyBreaker
No description
resumePolicyWave
No description
retryAssignedResource
No description
retryFailedGrantsByIntegration
No description
retryFailedGrants
No description
retryFailedPolicyRollout
No description
retryProvisioningOperation
No description
retryReactionExecution
No description
retrySyncRun
No description
revokeAccess
No description
revokeAPIKey
No description
revokeExemption
No description
revokeGateway
No description
revokeRole
No description
rollbackFunctionLiveVersion
No description
rotateIdpClientSecret
No description
rotateIdpSigningKey
No description
runReviewCampaignDefinition
"Run" — mint a fresh DRAFT instance copying the definition's name/description/scope/policy, assigning runnumber and dueat = now + dueOffsetDays. Gated review.campaign.manage only: the minter RUNS a policy an authorized author configured (authoring stays gated at definition writes).
setFunctionOwlieAccessRoles
No description
setFunctionOwlieAccess
No description
setGraphNodeRequestable
Set the target flag; resource.modify required. Applies across resources sharing a connector node.
setHandoverWindows
No description
setIdentityAttributeDefaultResolutionPolicy
No description
setIdentityLifecycleState
No description
setLifecyclePlacement
No description
setLoginEmail
No description
setMyAccountPassword
Set one account's password, when its resource lets people set it themselves (self_service).
setResourceDisposition
No description
setReviewCampaignDefinitionSchedule
Set / replace / clear (null) a definition's recurrence. A SEPARATE mutation, deliberately NOT folded into updateReviewCampaignDefinition: schedule writes recompute nextrunat and deserve an explicit surface. Gated review.campaign.manage only — the schedule re-RUNS a template whose policy writes were already gated.
setSignInAllowed
No description
stagePolicyVersion
No description
supersedeWaitingOperation
No description
testIntegrationConnection
No description
triggerSyncRun
No description
updateAccountSyncJob
No description
updateCustomActionDefinition
No description
updateCustomConnectorDraft
No description
updateCustomConnector
No description
updateDerivedStateAttribute
No description
updateDerivedStateRule
No description
updateEntitySyncJob
No description
updateFunctionDraft
No description
updateFunctionVersionSecrets
No description
updateFunction
No description
updateGrantTargetReviewPolicy
Set or clear a Grant target review-policy override.
updateGrantTargetRiskLevel
Set a Grant target's numeric risk level (1..5).
updateGroup
Update an existing group
updateIdentityAttribute
No description
updateIdentity
No description
updateIdpClient
No description
updateIntegrationEntitySchemas
No description
updateIntegration
No description
updateMyProfile
No description
updateReaction
No description
updateRelationshipSyncJob
No description
updateRequestComment
No description
updateResourceGrantTargets
Replace Grants for a resource and kind
updateResourceProfiles
Update resource profiles (provisioning profile, sync profile)
updateResource
Update an existing resource
updateReviewCampaignDefinition
Edit the template. Affects only FUTURE runs — already-minted instances copied their own scope/policy at mint.
updateReviewCampaign
Edit a DRAFT campaign's name / user+resource scope / policy / due date before launch.
updateRole
No description
updateSettings
Update settings for the current tenant
updateTenantMfaPolicy
Update tenant MFA policy settings
updateTenant
Update an existing tenant
updateTicket
No description
upsertNotificationPolicy
No description
useMyPasswordForAccounts
Push your verified Owlie password to one password-linked account, or to all of them.