Use OpalScript to automate access workflows

Build access management workflows with OpalScript.

​

Overview

OpalScript is Opal’s scripting language for automating access management workflows integrated deeply with Opal’s access management platform. Built on Starlark (a Python-like language), OpalScript enables you to write custom automation logic and scripts that evaluate conditions, query the access graph and take actions programmatically.

​

Use cases

OpalScript currently supports automated request review, delegation conditions, request configuration conditions, and Paladin context, with more automation types planned:

Script Type	Status	Description
Request Review	Available	Automatically approve, deny, or comment on access requests
Delegation Conditions	Available	Decide which delegates are eligible to cover a request
Request Configuration	Available	Decide whether a request configuration applies to a requested item
Paladin Context	Beta	Pull data from your own systems into a Paladin review
Additional types	Coming Soon	More automation capabilities will be added

New to OpalScript? The AI assistant can write a script for you from a plain-language description.

​

How OpalScript works

Each OpalScript type has access to:

1. Utility modules: Common functions shared across script types (e.g., access for access queries, notifications for sending notifications, http and secrets for calling external APIs). Which modules a script can use depends on its type. See Module availability by script type
2. Context module: Script-type-specific data about what triggered the script
3. Actions module: Script-type-specific operations the script can perform

This separation allows you to learn the core language and utility functions once, then apply them across different automation scenarios.

​

Create your first workflow

1. In Opal, navigate to Admin > OpalScript > Editor and create a new script. Give it a name and select an owner.

   For Request Review scripts, Opal provisions a service user with the same name as the script, owned by the owner you select. This service user is the identity that runs the script.

2. Enter your OpalScript in the editor. For example, to auto-approve all requests:

   actions.approve()
   

   See Request Review: Get started for the full context and actions API reference, and examples for ready-to-use scripts.

3. Attach the OpalScript to an approval stage on any resource, group, or configuration template (or via opal_script_ids in the REST API and Terraform). When a request reaches that stage, the script runs automatically.

For test runs, version history, triggers, and run monitoring, see Using the editor.

To keep scripts in version control and attach them to approval stages as code, see Manage OpalScripts with Terraform.