# Opal Security Docs

- [Quickstart](https://docs.opal.dev/docs/welcome.md): Explore our guides to enable Opal in your organization
- [Overview](https://docs.opal.dev/docs/opal-overview.md)
- [Concepts](https://docs.opal.dev/docs/opal-101.md): Learn about fundamental concepts and objects in Opal.
- [Opal architecture](https://docs.opal.dev/docs/opal-architecture.md): Learn about components in Opal's identity management platform.
- [Best practices for access requests](https://docs.opal.dev/docs/best-practices-for-access-requests.md): Learn about best practices for organizing and configuring resources.
- [Best practices for access reviews](https://docs.opal.dev/docs/best-practices-for-user-access-reviews.md)
- [Access Request FAQs](https://docs.opal.dev/docs/end-user-faq.md): Learn answers to frequently asked questions for end users requesting access with Opal.
- [Tips on searching](https://docs.opal.dev/docs/tips-on-searching.md): Find apps and resources in Opal using filters and search queries.
- [Complete Access Reviews](https://docs.opal.dev/docs/complete-access-reviews.md): Learn how to complete reviews in an Access Campaign.
- [Set up Cloud](https://docs.opal.dev/docs/set-up-cloud.md): Learn how to get started with Opal Cloud.
- [Set up Self-Hosted](https://docs.opal.dev/docs/self-host-overview.md): Learn the prerequisites required to deploy Opal on your own infrastructure.
- [Self-Hosted on AWS EKS](https://docs.opal.dev/docs/self-host-opal-aws-guide.md): Learn how to deploy Opal on AWS EKS.
- [Self-Hosted on GKE](https://docs.opal.dev/docs/self-host-opal-gke-guide.md): Learn how to deploy Opal on Google Cloud GKE.
- [Disaster recovery guide](https://docs.opal.dev/docs/disaster-recovery-guide.md)
- [Update your Opal installation](https://docs.opal.dev/docs/update-self-hosted-opal.md): Learn how to update your self-hosted Opal installation.
- [Install Opal using Helm](https://docs.opal.dev/docs/install-opal-using-helm.md)
- [Set up an Airgapped Opal Environment](https://docs.opal.dev/docs/setup-an-airgapped-opal-environment.md)
- [Configure Async Exports Storage (Self-Hosted)](https://docs.opal.dev/docs/configure-async-exports-storage.md): Provision an S3 bucket so your self-hosted Opal instance can serve async data exports.
- [Kubernetes Components and Health Monitoring](https://docs.opal.dev/docs/kubernetes-components-and-health-monitoring-guide.md): Learn about various kubernetes pods and jobs, and health monitoring recommendations on self-hosted Opal.
- [Connect Identity or HR Providers](https://docs.opal.dev/docs/connect-your-identity-provider-idp.md)
- [Add your first IDP/HR provider](https://docs.opal.dev/docs/add-your-first-idphr-provider.md)
- [Add additional IDP/HR providers](https://docs.opal.dev/docs/add-additional-idphr-providers.md)
- [Import user secondary emails](https://docs.opal.dev/docs/importing-user-secondary-email.md): Learn how to consolidate access for users with multiple email addresses.
- [Connect Productivity Tools](https://docs.opal.dev/docs/connect-your-productivity-tools.md): Learn how to connect Opal with your existing productivity tools.
- [Connect Apps and Infrastructure](https://docs.opal.dev/docs/set-up-connections.md)
- [Import and configure resources](https://docs.opal.dev/docs/import-and-configure-resources-and-groups.md)
- [Opal's server IP ranges](https://docs.opal.dev/docs/ip-ranges.md)
- [Configure SSO and MFA](https://docs.opal.dev/docs/configure-sso-and-mfa.md): Learn how to set up MFA for Opal logins and actions.
- [SSO with SAML](https://docs.opal.dev/docs/sso-with-saml.md): Learn how to set up SAML SSO to authenticate users to Opal.
- [Google SAML Setup](https://docs.opal.dev/docs/google-saml-setup.md): Learn how to configure Opal to authenticate users via Google SAML SSO.
- [Okta SAML Setup](https://docs.opal.dev/docs/okta-saml-setup.md): Learn how to configure Opal to authenticate users via Okta SAML SSO.
- [Okta Multifactor Authentication](https://docs.opal.dev/docs/okta-multifactor-authentication.md)
- [Okta SCIM: Provision Opal Users](https://docs.opal.dev/docs/okta-scim-integration.md)
- [OIDC Provider Setup for Opal Actions](https://docs.opal.dev/docs/oidc-provider-setup-for-opal-actions.md)
- [Curate end-user catalog](https://docs.opal.dev/docs/curate-catalog.md)
- [Bundles](https://docs.opal.dev/docs/bundles.md): Learn how to use bundles to group commonly used resources.
- [Configure reviewers](https://docs.opal.dev/docs/configure-reviewers.md): Learn how to configure required reviewers for access requests.
- [Escalate if no response](https://docs.opal.dev/docs/escalate-if-no-response.md): Automatically move an access request to a second set of reviewers when the first reviewers don't respond in time.
- [Request on behalf rules](https://docs.opal.dev/docs/request-on-behalf.md): Learn how request configurations and visibility settings affect requesting access on behalf of other users.
- [Delegate reviews](https://docs.opal.dev/docs/delegate-reviews.md): Learn how to schedule delegated access request reviews.
- [Configuration templates](https://docs.opal.dev/docs/configuration-templates.md)
- [Manage access with ticketing](https://docs.opal.dev/docs/ticket-propagation.md)
- [Access Rules](https://docs.opal.dev/docs/access-rules.md): Use Access Rules to enforce access policies at scale.
- [Risk Center](https://docs.opal.dev/docs/least-privilege-posture-management.md): Use the Risk Center to gain insights on your least privilege posture.
- [Overview](https://docs.opal.dev/docs/manage-groups-in-opal.md): Learn about the different features Opal provides to manage groups.
- [Manage break-glass access](https://docs.opal.dev/docs/manage-breakglass-access.md): Learn how to set up groups and users to support break-glass access paths.
- [Nested groups](https://docs.opal.dev/docs/nested-groups.md): Learn how to set up nested groups in Opal.
- [Group aliasing](https://docs.opal.dev/docs/okta-group-aliasing.md)
- [Linked groups](https://docs.opal.dev/docs/linked-groups.md): Learn how to link identical groups in Opal and set one as the source of truth.
- [Group leaders](https://docs.opal.dev/docs/group-projects.md)
- [Notifications](https://docs.opal.dev/docs/notifications.md): Learn about the types of notifications sent by Opal.
- [Special roles in Opal](https://docs.opal.dev/docs/roles-in-opal.md)
- [Owner Permissions](https://docs.opal.dev/docs/owner-permissions.md): Learn what owner permissions are and how to customize them.
- [Custom Opal roles](https://docs.opal.dev/docs/custom-opal-roles.md): Learn how to create custom Opal roles.
- [User provisioning](https://docs.opal.dev/docs/user-provisioning.md): Learn about user provisioning and deprovisioning in Opal.
- [Access Comparison](https://docs.opal.dev/docs/access-comparison.md): Learn how to use our access comparison tool
- [Agent Inventory](https://docs.opal.dev/docs/agent-inventory.md): Track and govern the AI agents operating in your organization from a dedicated inventory.
- [OpenAI and ChatGPT](https://docs.opal.dev/docs/openai-chatgpt-setup.md): Connect OpenAI to Opal to bring OpenAI agents, service accounts, and ChatGPT user agents into Agent Inventory.
- [Anthropic Setup](https://docs.opal.dev/docs/anthropic-agent-setup.md): Connect your Anthropic organization to Opal and sync Claude agents into Agent Inventory.
- [Use OpalScript to automate access workflows](https://docs.opal.dev/docs/opalscript-overview.md): Build access management workflows with OpalScript.
- [Work with scripts in the OpalScript editor](https://docs.opal.dev/docs/opalscript-editor.md): Create, test, version, and monitor OpalScript automations from the editor.
- [Write OpalScript with AI](https://docs.opal.dev/docs/opalscript-ai-assistant.md): Describe an automation in plain language and let the OpalScript assistant write, validate, and dry-run the script for you.
- [Utility Modules for OpalScript](https://docs.opal.dev/docs/opalscript-utilitymodules.md): Learn about how to use OpalScript's Utility Modules to automate access management workflows.
- [Start automating workflows around requests](https://docs.opal.dev/docs/requestreview-getstarted.md): Learn how to create request review scripts in OpalScript.
- [Request Review Example Scripts](https://docs.opal.dev/docs/requestreview-examples.md): Learn to use Request Review scripts through examples.
- [Control who can cover a request with delegation conditions](https://docs.opal.dev/docs/opalscript-delegation-conditions.md): Write delegation-condition scripts in OpalScript to decide which delegates are eligible to cover an access request.
- [Choose a request configuration with OpalScript](https://docs.opal.dev/docs/opalscript-request-configuration-conditions.md): Write request configuration condition scripts in OpalScript to decide which request configuration applies when a user requests a resource or group.
- [Give Paladin extra context with context provider scripts](https://docs.opal.dev/docs/opalscript-context-provider.md): Write Paladin context scripts in OpalScript to pull data from your own systems into a Paladin review.
- [Manage OpalScripts with Terraform](https://docs.opal.dev/docs/opalscript-terraform.md): Create, version, and attach OpalScripts as code with Opal's Terraform provider.
- [OpalScript Reference](https://docs.opal.dev/docs/opalscript-reference.md): Learn language basics and quickly reference OpalScript functions.
- [Use Paladin to scale your security function](https://docs.opal.dev/docs/paladin/overview.md): Scale your security function and automate routine operations using Paladin agents.
- [Review access requests with Paladin](https://docs.opal.dev/docs/paladin/access-request.md): Use a Paladin agent to investigate and decide on access requests within your existing approval chains.
- [Review access campaigns with Paladin Insights](https://docs.opal.dev/docs/paladin/access-reviews.md): Use Paladin Insights to group similar access in an access campaign and suggest bulk approve or revoke decisions to reviewers.
- [Model providers](https://docs.opal.dev/docs/paladin/model-providers.md): Choose where Paladin and Opal's other AI features run inference: on Opal's Anthropic account, your own Anthropic account, or your own Amazon Bedrock account.
- [Set up Paladin on self-hosted Opal](https://docs.opal.dev/docs/paladin/self-hosted-setup.md): Turn on Paladin in a self-hosted Opal deployment: connect a model provider, create the agent, run it on every request in monitor mode, and go live when you're ready.
- [Overview](https://docs.opal.dev/docs/opal-query.md): Explore and analyze access across your organization with OpalQuery.
- [Node queries](https://docs.opal.dev/docs/opal-query-node.md): Find and inventory entities — users, resources, and groups — that match filters and access relationships.
- [Access queries](https://docs.opal.dev/docs/opal-query-access.md): Investigate access itself — who can reach which assets, at what access level, and how.
- [Query API](https://docs.opal.dev/docs/opal-query-api.md): Run ad-hoc OpalQuery requests over HTTP to find entities and traverse access relationships.
- [Create Access Campaigns](https://docs.opal.dev/docs/access-campaigns.md): Learn how to create a User Access Campaign.
- [Manage Access Campaign](https://docs.opal.dev/docs/managing-access-campaigns.md): Learn how to manage your Access Campaign.
- [Create Access Reviews](https://docs.opal.dev/docs/access-reviews-legacy.md): Learn how to create and configure User Access Reviews in Opal.
- [Assign and complete reviews](https://docs.opal.dev/docs/assigning-and-completing-reviews-legacy.md): Learn how to assign and complete User Access reviews in Opal.
- [Manage reviews](https://docs.opal.dev/docs/managing-user-access-reviews-legacy.md): Learn how to manage User Access Reviews.
- [Events](https://docs.opal.dev/docs/event-types.md): Use Events to audit access updates and additional events in Opal.
- [Events Streaming](https://docs.opal.dev/docs/events-streaming.md): Set up Opal to stream Events to your logging destination in near real-time.
- [Metrics dashboard](https://docs.opal.dev/docs/metrics.md): Learn about Opal's built-in analytics and metrics.
- [Sync schedules and triggers](https://docs.opal.dev/docs/sync-schedules-and-triggers.md): Learn how Opal syncs apps, groups, resources, and users from remote systems.
- [Overview](https://docs.opal.dev/docs/custom-integrations-overview.md): Learn about different options for building custom integrations in Opal.
- [Create your own connector](https://docs.opal.dev/docs/how-to-create-your-own-connector.md): Learn how to build custom connectors to connect Opal with any end system.
- [Custom Connector API Spec](https://docs.opal.dev/docs/api-spec.md)
- [Webhooks](https://docs.opal.dev/docs/webhooks.md): Learn how to configure webhooks to push changes on access requests.
- [Opal CLI](https://docs.opal.dev/docs/opal-cli.md): Learn how to configure and use the Opal CLI.
- [Use Terraform with Opal](https://docs.opal.dev/docs/use-terraform-with-opal.md): Learn how to set up Opal's Terraform provider.
- [Model Context Protocol (MCP)](https://docs.opal.dev/docs/mcp/overview.md): Let your AI Agents interact with Opal by using our MCP server.
- [End User MCP Server](https://docs.opal.dev/docs/mcp/end-user.md): Let end users interact with Opal using our end user MCP server.
- [Admin Provisioning MCP Server](https://docs.opal.dev/docs/mcp/admin-provisioning.md): Let admins manage access with Opal using our Admin Provisioning MCP server.
- [Admin Auditing MCP Server](https://docs.opal.dev/docs/mcp/admin-auditing.md): Let admins audit access with Opal using our Admin Auditing MCP server.
- [Okta Cross App Access (XAA)](https://docs.opal.dev/docs/mcp/okta-cross-app-access.md): Let AI agents connect to Opal's MCP servers on behalf of your Okta users, without an interactive sign-in.
- [Legacy MCP](https://docs.opal.dev/docs/mcp/gram-mcp-servers.md): Learn how to install and use Opal's Gram-hosted MCP servers.
- [Integrations](https://docs.opal.dev/integrations/overview.md): Integrate your tools with Opal to enable deterministic enforcement
- [Okta](https://docs.opal.dev/integrations/okta.md): Connect your Okta instance to use Opal to manage and review access.
- [Okta IDP/HRIS Integration](https://docs.opal.dev/integrations/okta-idphris-integration.md)
- [Import Okta apps](https://docs.opal.dev/integrations/okta-apps.md): Learn how to import your Okta apps into Opal.
- [Okta rate limits](https://docs.opal.dev/integrations/okta-rate-limits.md): Learn about rate limits that may affect your Okta integration with Opal.
- [Google](https://docs.opal.dev/integrations/google.md)
- [Google IDP/HRIS Integration](https://docs.opal.dev/integrations/google-idphris-integration.md)
- [Google Groups](https://docs.opal.dev/integrations/google-groups.md): Connect your Google Groups organization to Opal to manage and review access.
- [Google Shared Drive](https://docs.opal.dev/integrations/google-shared-drive.md): Learn how to connect Opal to Google Workspace to manage access to shared drives.
- [Google Workspace](https://docs.opal.dev/integrations/google-workspace.md): Learn how to connect Google Workspace with Opal.
- [Azure](https://docs.opal.dev/integrations/azure.md): Learn how to connect Opal to Azure to manage access.
- [Azure Entra IDP/HRIS Integration](https://docs.opal.dev/integrations/azure-entra-idphris-integration.md): Learn how to configure Azure Entra as an IDP/HRIS Integration.
- [Azure Infrastructure Setup](https://docs.opal.dev/integrations/azure-infrastructure-setup.md)
- [Add Azure Databases](https://docs.opal.dev/integrations/adding-azure-sql-databases.md): Add Azure databases to grant users temporary access.
- [Azure Real Time Sync Setup](https://docs.opal.dev/integrations/azure-real-time-sync.md)
- [Overview](https://docs.opal.dev/integrations/active-directory.md): Connect your Active Directory server to use Opal to manage and review access.
- [Active Directory IDP/HRIS Integration](https://docs.opal.dev/integrations/active-directory-idphris-integration.md)
- [Overview](https://docs.opal.dev/integrations/workday.md): Learn how to connect your Workday tenant to Opal.
- [Workday IDP/HRIS Integration](https://docs.opal.dev/integrations/workday-idphris-integration.md): Learn how to connect Workday to Opal as an IDP/HRIS integration.
- [Rippling IDP/HRIS Integration](https://docs.opal.dev/integrations/rippling-idphris-integration.md): Learn how to connect Rippling to Opal as an IDP/HRIS integration.
- [Amazon Web Services (AWS)](https://docs.opal.dev/integrations/setting-up-your-aws-organization-in-opal.md): Connect your AWS infrastructure to use Opal to manage and review access.
- [Configure AWS for self-hosted Opal](https://docs.opal.dev/integrations/aws-integration-on-prem-setup.md)
- [Configure additional AWS accounts to manage in Opal](https://docs.opal.dev/integrations/configure-additional-aws-accounts-to-manage-in-opal.md): Learn how to configure additional AWS accounts so you can manage and review access in Opal.
- [AWS IAM Identity Center Workflows](https://docs.opal.dev/integrations/aws-iam-identity-center-formerly-aws-sso.md): Manage your permission sets, users, and groups in Opal
- [Add an IAM role](https://docs.opal.dev/integrations/adding-an-iam-role.md): Add your AWS IAM roles to Opal to allow your developers to request temporary access.
- [Add an RDS database](https://docs.opal.dev/integrations/adding-an-rds-database.md): Add your AWS RDS databases to Opal to allow your developers to request temporary access.
- [Add an EC2 instance](https://docs.opal.dev/integrations/adding-an-ec2-instance.md): Add your AWS EC2 instances to Opal to allow your developers to request temporary access.
- [Add an EKS cluster](https://docs.opal.dev/integrations/adding-an-eks-cluster.md): Add your AWS EKS clusters to Opal to allow your developers to request temporary access.
- [Adding AWS Resources to Opal Groups via AWS Tags](https://docs.opal.dev/integrations/adding-aws-resources-to-opal-groups-via-aws-tags.md)
- [AWS Real Time Sync Setup](https://docs.opal.dev/integrations/aws-real-time-sync.md)
- [Google Cloud Platform (GCP)](https://docs.opal.dev/integrations/google-cloud-platform.md): Connect your GCP infrastructure to use Opal to manage and review access.
- [Add an organization](https://docs.opal.dev/integrations/adding-gcp-organization.md): Read about how to add a GCP organization to Opal so you can manage temporary access to them.
- [Add a project](https://docs.opal.dev/integrations/adding-gcp-project.md): Read about how to add a GCP project to Opal so you can manage temporary access to them.
- [Add a folder](https://docs.opal.dev/integrations/adding-gcp-folder.md): Learn how to add a GCP folder to Opal so you can manage temporary access to them.
- [Add a BigQuery Dataset](https://docs.opal.dev/integrations/adding-bigquery-dataset.md)
- [Add a Cloud Storage bucket](https://docs.opal.dev/integrations/adding-gcp-bucket.md)
- [Add a Cloud SQL Instance](https://docs.opal.dev/integrations/adding-sql-instance.md)
- [Add a Compute Engine Instance](https://docs.opal.dev/integrations/adding-compute-instance.md)
- [Google Kubernetes Engine (GKE)](https://docs.opal.dev/integrations/google-kubernetes-engine-getting-started.md): Learn how to manage user access with Google Kubernetes Engine (GKE).
- [GCP Service Accounts](https://docs.opal.dev/integrations/gcp-service-accounts.md): Add and manage Google Cloud Platform (GCP) service accounts in Opal.
- [Snowflake](https://docs.opal.dev/integrations/snowflake.md): Learn how to connect your Snowflake account and use Opal to manage and review access.
- [Snowflake User Provisioning](https://docs.opal.dev/integrations/snowflake-user-provisioning.md)
- [1Password](https://docs.opal.dev/integrations/1password.md): Learn how to connect Opal to 1Password, through your identity provider or a connector you host, to manage vault access and group membership.
- [Anthropic Platform](https://docs.opal.dev/integrations/anthropic.md): Learn how to connect your Opal instance with Anthropic.
- [Astra](https://docs.opal.dev/integrations/astra.md): Learn how to connect your Opal instance with Astra.
- [Axiom](https://docs.opal.dev/integrations/axiom.md): Learn how to connect Opal to Axiom so you can invite people, change their built-in role, and manage group access.
- [Box](https://docs.opal.dev/integrations/box.md): Learn how to connect Opal to Box to manage access to folders, group membership, and the co-admin role.
- [Clickhouse](https://docs.opal.dev/integrations/clickhouse.md): Learn how to connect Opal to Clickhouse to manage access.
- [Atlassian Confluence](https://docs.opal.dev/integrations/confluence.md): Learn how to connect your Opal instance with Confluence.
- [Coupa](https://docs.opal.dev/integrations/coupa.md): Learn how to connect Opal with Coupa.
- [Cursor](https://docs.opal.dev/integrations/cursor.md): Learn how to connect Opal with Cursor.
- [Databricks](https://docs.opal.dev/integrations/databricks.md): Learn how to connect your Opal instance to Databricks.
- [Datadog](https://docs.opal.dev/integrations/datadog.md): Learn how to connect your Datadog instance to Opal to manage and review access.
- [Devin AI](https://docs.opal.dev/integrations/devin.md): Learn how to connect your Opal instance with Devin AI.
- [Docusign](https://docs.opal.dev/integrations/docusign.md): Learn how to connect Opal with Docusign to manage and review access.
- [Duo](https://docs.opal.dev/integrations/duo.md): Connect your Duo instance to use Opal to manage and review access.
- [GitHub](https://docs.opal.dev/integrations/github.md): Connect Opal to your GitHub organization to manage and review access.
- [GitHub Enterprise](https://docs.opal.dev/integrations/github-enterprise.md): Connect Opal to your GitHub Enterprise account to manage and review access.
- [GitLab](https://docs.opal.dev/integrations/gitlab.md): Connect Opal to your GitLab instance or group to manage and review access.
- [Grafana](https://docs.opal.dev/integrations/grafana.md): Learn how to connect Opal to Grafana to manage access to Grafana folders, dashboards, roles, and teams.
- [Hubspot](https://docs.opal.dev/integrations/hubspot.md): Learn how to connect Opal to Hubspot to manage access.
- [Incident.io](https://docs.opal.dev/integrations/incidentio.md): Learn how to connect Incident.io to Opal.
- [Atlassian Jira](https://docs.opal.dev/integrations/jira.md): Learn how to connect your Opal instance with Jira.
- [LDAP](https://docs.opal.dev/integrations/ldap.md): Connect your LDAP server to use Opal to manage and review access.
- [Linear](https://docs.opal.dev/integrations/linear.md): Learn how to connect your Opal instance with Linear.
- [NetSuite](https://docs.opal.dev/integrations/netsuite.md): Learn how to connect your NetSuite instance with Opal to manage and review access.
- [Okta CIAM](https://docs.opal.dev/integrations/okta-ciam.md): Connect your Okta CIAM instance to Opal to manage and review access.
- [OneLogin](https://docs.opal.dev/integrations/onelogin.md): Learn how to connect Opal to OneLogin to manage users, roles, groups, and apps.
- [OpenAI Platform](https://docs.opal.dev/integrations/openai.md): Learn how to connect Opal with OpenAI Platform.
- [Oracle Fusion Cloud](https://docs.opal.dev/integrations/oracle-fusion-cloud.md): Learn how to connect your Oracle Fusion Cloud instance to Opal to manage and review access.
- [PagerDuty](https://docs.opal.dev/integrations/pagerduty-entitlements.md): Learn how to connect your PagerDuty accounts with Opal to manage and review access.
- [Ramp](https://docs.opal.dev/integrations/ramp.md): Learn how to connect Opal to Ramp to manage users, roles, and funds.
- [Rippling](https://docs.opal.dev/integrations/rippling.md): Learn how to connect Opal to Rippling to manage access to Rippling supergroups, and to sync employees, departments, and teams.
- [Rootly](https://docs.opal.dev/integrations/rootly.md): Learn how to connect Rootly to Opal.
- [Salesforce](https://docs.opal.dev/integrations/salesforce.md): Learn how to connect your Salesforce accounts with Opal to manage and review access.
- [Slack users and groups](https://docs.opal.dev/integrations/slack-user-groups.md): Connect your Slack workspace to Opal to manage and review access to Slack users and groups.
- [Square](https://docs.opal.dev/integrations/square.md): Learn how to connect Opal to Square to manage team members and location access.
- [Salesforce Tableau](https://docs.opal.dev/integrations/tableau.md): Learn how to connect your Opal instance with Tableau.
- [Tailscale](https://docs.opal.dev/integrations/tailscale.md): Learn how to connect Opal to Tailscale to manage SSH access within your tailnet.
- [Teleport](https://docs.opal.dev/integrations/teleport.md): Learn how to connect Opal to Teleport to manage access to Teleport roles.
- [Twingate](https://docs.opal.dev/integrations/twingate.md): Learn how to connect Opal to Twingate to manage access to Twingate groups and resources.
- [Vercel](https://docs.opal.dev/integrations/vercel.md): Learn how to connect a Vercel team to Opal to manage and review access.
- [Workato](https://docs.opal.dev/integrations/workato.md): Learn how to connect Opal to Workato to manage project roles and collaborator group membership.
- [Workday groups and roles](https://docs.opal.dev/integrations/workday-groups-and-roles.md): Learn how to manage access to Workday groups and roles.
- [Wrike](https://docs.opal.dev/integrations/wrike.md): Learn how to connect Opal to Wrike to manage users, groups, and user types.
- [Zendesk](https://docs.opal.dev/integrations/zendesk.md): Learn how to connect Opal to Zendesk to manage access to Zendesk groups, organizations, and custom roles.
- [Zoom](https://docs.opal.dev/integrations/zoom.md): Learn how to connect your Zoom instance to Opal to manage and review access.
- [Google Chat](https://docs.opal.dev/integrations/google-chat.md): Learn how to connect Opal to Google Chat.
- [Lark](https://docs.opal.dev/integrations/lark.md): Learn how to connect Opal to Lark to send notifications and manage access requests.
- [Microsoft Teams](https://docs.opal.dev/integrations/microsoft-teams.md): Learn how to connect Opal to Microsoft Teams to send notifications and manage access requests.
- [Slack](https://docs.opal.dev/integrations/slack.md): Learn how to connect your Opal instance to Slack.
- [Freshservice](https://docs.opal.dev/integrations/freshservice.md): Learn how to connect your Opal instance with Freshservice
- [Jira](https://docs.opal.dev/integrations/jira-ticketing.md): Learn how to connect your Opal instance with Jira.
- [Linear](https://docs.opal.dev/integrations/linear-ticketing.md)
- [Notion](https://docs.opal.dev/integrations/notion.md): Learn how to connect your Opal instance with Notion.
- [Risotto](https://docs.opal.dev/integrations/risotto.md): Learn how to connect Opal in Risotto.
- [ServiceNow](https://docs.opal.dev/integrations/servicenow.md): Learn how to connect ServiceNow to Opal.
- [Shortcut](https://docs.opal.dev/integrations/shortcut.md): Learn how to connect your Opal instance with Shortcut
- [Opsgenie](https://docs.opal.dev/integrations/opsgenie.md): Learn how to connect Opal to Opsgenie.
- [PagerDuty](https://docs.opal.dev/integrations/pagerduty-oncall.md): Learn how to connect PagerDuty to Opal.
- [Authentication](https://docs.opal.dev/reference/authentication.md): Learn how to authenticate your requests to the Opal API.
- [Pagination](https://docs.opal.dev/reference/pagination.md): Learn how to paginate bulk data requests to the Opal API.
- [Identifying End System Objects](https://docs.opal.dev/reference/end-system-objects.md): Learn how Opal tracks the resources and groups that it syncs with end systems.
- [Opal API Rate Limits](https://docs.opal.dev/reference/opal-api-rate-limits.md)
- [Overview](https://docs.opal.dev/reference/opal-sdks.md): Supported SDKs:
- [Report agent activity](https://docs.opal.dev/api-reference/agent-activity/report-agent-activity.md): **Prototype (AG-285).** Reports activity observed by an agent runtime on a developer's machine - today, Claude Code hook events.
- [Anthropic inference hook verdict](https://docs.opal.dev/api-reference/agent-activity/anthropic-inference-hook-verdict.md): **Prototype (AG-336).** The AI security server endpoint for Anthropic Inference hooks. Anthropic POSTs each governed frame here and waits for an allow or deny verdict. Configure it in claude.ai with this URL and a custom `Authorization: Bearer <Opal API key>` request header.
- [Get the agent kill switch](https://docs.opal.dev/api-reference/agent-activity/get-the-agent-kill-switch.md): **Prototype (AG-297).** Returns whether agent tool calls are currently being denied for this organization, and the activation that is in force or that last was.
- [Set the agent kill switch](https://docs.opal.dev/api-reference/agent-activity/set-the-agent-kill-switch.md): **Prototype (AG-297).** Turns the org-level agent kill switch on or off. Admin only.
- [Get apps](https://docs.opal.dev/api-reference/apps/get-apps.md): Returns a list of `App` objects.
- [Create app](https://docs.opal.dev/api-reference/apps/create-app.md): Creates an `App` in Opal. Currently supports only Push-only apps (`CUSTOM`) and Custom Connector apps (`CUSTOM_CONNECTOR`).
- [Get app by ID](https://docs.opal.dev/api-reference/apps/get-app-by-id.md): Returns an `App` object.
- [Update app](https://docs.opal.dev/api-reference/apps/update-app.md): Updates an `App`. Currently supports only Push-only apps (`CUSTOM`) and Custom Connector apps (`CUSTOM_CONNECTOR`).
- [Delete app](https://docs.opal.dev/api-reference/apps/delete-app.md): Deletes an `App`. Currently supports only Push-only apps (`CUSTOM`) and Custom Connector apps (`CUSTOM_CONNECTOR`). Matches the UI: soft-deletes the app and cleans up its resources, groups, and users.
- [Get app visibility](https://docs.opal.dev/api-reference/apps/get-app-visibility.md): Returns the visibility of this app.
- [Set app visibility](https://docs.opal.dev/api-reference/apps/set-app-visibility.md): Sets the visibility of this app. Preferred over setting `visibility` / `visibility_group_ids` / `import_visibility` inline on `POST /apps` or `PATCH /apps/{app_id}` for drift-sensitive callers (Terraform, GitOps). Semantics are a replace, not a merge: `visibility_group_ids` is written to exactly wha…
- [Get sync errors](https://docs.opal.dev/api-reference/apps/get-sync_errors.md): Returns a list of recent sync errors that have occurred since the last successful sync.
- [Get bundles](https://docs.opal.dev/api-reference/bundles/get-bundles.md): Returns a list of `Bundle` objects.
- [Post bundles](https://docs.opal.dev/api-reference/bundles/post-bundles.md): Creates a bundle.
- [Get bundle by ID](https://docs.opal.dev/api-reference/bundles/get-bundle-by-id.md): Returns a `Bundle` object.
- [Put bundles](https://docs.opal.dev/api-reference/bundles/put-bundles.md): Updates a bundle.
- [Delete bundles](https://docs.opal.dev/api-reference/bundles/delete-bundles.md): Deletes a bundle.
- [Get bundles resources](https://docs.opal.dev/api-reference/bundles/get-bundles-resources.md): Returns a list of `Resource` objects in a given bundle.
- [Post bundles resources](https://docs.opal.dev/api-reference/bundles/post-bundles-resources.md): Adds a resource to a bundle.
- [Delete bundles resources](https://docs.opal.dev/api-reference/bundles/delete-bundles-resources.md): Removes a resource from a bundle.
- [Get bundles groups](https://docs.opal.dev/api-reference/bundles/get-bundles-groups.md): Returns a list of `Group` objects in a given bundle.
- [Post bundles groups](https://docs.opal.dev/api-reference/bundles/post-bundles-groups.md): Adds a group to a bundle.
- [Delete bundles groups](https://docs.opal.dev/api-reference/bundles/delete-bundles-groups.md): Removes a group from a bundle.
- [Get bundles visibility](https://docs.opal.dev/api-reference/bundles/get-bundles-visibility.md): Gets the visibility of the bundle.
- [Put bundles visibility](https://docs.opal.dev/api-reference/bundles/put-bundles-visibility.md): Sets the visibility of the bundle.
- [Get campaigns](https://docs.opal.dev/api-reference/campaigns/get-campaigns.md): Returns a list of `Campaign` objects.
- [Post campaigns](https://docs.opal.dev/api-reference/campaigns/post-campaigns.md): Creates a campaign. Campaign scope only supports direct access edges: `configuration.query.edgeFilter.directOnly` defaults to `true`, is always stored as `true`, and passing `false` returns 400.
- [Get campaign by ID](https://docs.opal.dev/api-reference/campaigns/get-campaign-by-id.md): Returns a `Campaign` object.
- [Update campaign](https://docs.opal.dev/api-reference/campaigns/update-campaign.md): Partially updates a campaign. Omitted fields are left unchanged. `configuration.query` and `configuration.reviewer_assignment_policy` cannot be updated after create; including either field returns 400. `configuration.cron_expression` and `configuration.recurring_duration_days` may only be set on tem…
- [Start campaign](https://docs.opal.dev/api-reference/campaigns/start-campaign.md): Starts a draft campaign immediately, setting `started_at` and `started_by_user_id`. Returns 400 if the campaign is not in draft state, or if it is a recurring template (`is_template: true`) — templates spawn draft campaigns on their schedule and cannot be started directly.
- [Stop campaign](https://docs.opal.dev/api-reference/campaigns/stop-campaign.md): Stops an ongoing campaign immediately, setting `stopped_at` and `stopped_by_user_id`. Returns 400 if the campaign has not started or has already stopped.
- [End campaign](https://docs.opal.dev/api-reference/campaigns/end-campaign.md): Ends a stopped campaign, setting `ended_at` and `ended_by_user_id`, applying pending access changes, and queuing report generation. Returns 400 unless the campaign is started and stopped and not already ended.
- [List campaign items](https://docs.opal.dev/api-reference/campaigns/list-campaign-items.md): Returns a paginated list of review items for a campaign — the same rows shown on the admin Reviews tab. Status is derived using the same rules as the UI Status column. Soft-deleted role assignments are still returned with `is_target_deleted: true`.
- [Update campaign item reviewers](https://docs.opal.dev/api-reference/campaigns/update-campaign-item-reviewers.md): Atomically assigns and unassigns reviewers on campaign items in one request. All `campaign_item_id`s must belong to `{campaign_id}`. Existing assign pairs are ignored; missing unassign pairs are skipped. Completed reviews (`decided_at` set) are never removed. Requires settings-edit permission. Retur…
- [Submit campaign item review decisions](https://docs.opal.dev/api-reference/campaigns/submit-campaign-item-review-decisions.md): Submits one or more review decisions for campaign item reviews assigned to the authenticated user. Mirrors the GraphQL `reviewCampaignItems` mutation.
- [List viewer campaign items](https://docs.opal.dev/api-reference/campaigns/list-viewer-campaign-items.md): Returns a paginated list of campaign review items assigned to the current authenticated viewer. Matches GraphQL `Campaign.viewerItems`.
- [Get configuration templates](https://docs.opal.dev/api-reference/configuration-templates/get-configuration-templates.md): Returns a list of `ConfigurationTemplate` objects.
- [Put configuration templates](https://docs.opal.dev/api-reference/configuration-templates/put-configuration-templates.md): Update a configuration template.
- [Post configuration templates](https://docs.opal.dev/api-reference/configuration-templates/post-configuration-templates.md): Creates a configuration template.
- [Delete configuration templates](https://docs.opal.dev/api-reference/configuration-templates/delete-configuration-templates.md): Deletes a configuration template.
- [Get event streams](https://docs.opal.dev/api-reference/event-streams/get-event-streams.md): Returns a list of configured event streaming connections for your organization.
- [Create event stream](https://docs.opal.dev/api-reference/event-streams/create-event-stream.md): Creates a new event streaming connection.
- [Update event stream](https://docs.opal.dev/api-reference/event-streams/update-event-stream.md): Updates an existing event streaming connection.
- [Delete event stream](https://docs.opal.dev/api-reference/event-streams/delete-event-stream.md): Deletes an event streaming connection.
- [Get events](https://docs.opal.dev/api-reference/events/get-events.md): Returns a list of `Event` objects.
- [Get event by ID](https://docs.opal.dev/api-reference/events/get-event-by-id.md): Returns an `Event` object.
- [Get groups](https://docs.opal.dev/api-reference/groups/get-groups.md): Returns a list of groups for your organization.
- [Put groups](https://docs.opal.dev/api-reference/groups/put-groups.md): Bulk updates a list of groups.
- [Post groups](https://docs.opal.dev/api-reference/groups/post-groups.md): Creates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects).
- [Get group by ID](https://docs.opal.dev/api-reference/groups/get-group-by-id.md): Returns a `Group` object.
- [Delete groups](https://docs.opal.dev/api-reference/groups/delete-groups.md): Deletes a group.
- [Get the ID of the configuration template linked to a group](https://docs.opal.dev/api-reference/groups/get-the-id-of-the-configuration-template-linked-to-a-group.md): Returns the ID of the configuration template that the group is currently linked to. The response body is `{"configuration_template_id": "<uuid>" | null}`:
- [Set the ID of the configuration template linked to a group](https://docs.opal.dev/api-reference/groups/set-the-id-of-the-configuration-template-linked-to-a-group.md): Attaches, repoints, or detaches the configuration template linked to a group. This endpoint only manages the link (by ID) between a group and an existing configuration template — it does not create, modify, or delete the template itself. To manage a template's own fields (name, description, request…
- [Get groups message channels](https://docs.opal.dev/api-reference/groups/get-groups-message-channels.md): Gets the list of audit and reviewer message channels attached to a group.
- [Put groups message channels](https://docs.opal.dev/api-reference/groups/put-groups-message-channels.md): Sets the list of audit message channels attached to a group.
- [Get groups on call schedules](https://docs.opal.dev/api-reference/groups/get-groups-on-call-schedules.md): Gets the list of on call schedules attached to a group.
- [Put groups on call schedules](https://docs.opal.dev/api-reference/groups/put-groups-on-call-schedules.md): Sets the list of on call schedules attached to a group.
- [Get group access levels](https://docs.opal.dev/api-reference/groups/get-group-access-levels.md): Returns the list of access levels defined for the group. Groups that only offer default (unnamed) access return an empty list.
- [Get groups resources](https://docs.opal.dev/api-reference/groups/get-groups-resources.md): Gets the list of resources that the group gives access to.
- [Put groups resources](https://docs.opal.dev/api-reference/groups/put-groups-resources.md): Sets the list of resources that the group gives access to.
- [Get member groups](https://docs.opal.dev/api-reference/groups/get-member-groups.md): Gets the list of groups that are nested directly in the group (its member groups).
- [Get nested groups](https://docs.opal.dev/api-reference/groups/get-nested-groups.md): Gets the list of groups that the group gives access to.
- [Post groups containing groups](https://docs.opal.dev/api-reference/groups/post-groups-containing-groups.md): Creates a new containing group.
- [Get nested group by ID](https://docs.opal.dev/api-reference/groups/get-nested-group-by-id.md): Gets a specific containing group for a group.
- [Delete groups containing groups](https://docs.opal.dev/api-reference/groups/delete-groups-containing-groups.md): Removes a containing group from a group.
- [Post groups resources](https://docs.opal.dev/api-reference/groups/post-groups-resources.md): Adds a resource to a group.
- [Get groups visibility](https://docs.opal.dev/api-reference/groups/get-groups-visibility.md): Gets the visibility of this group.
- [Put groups visibility](https://docs.opal.dev/api-reference/groups/put-groups-visibility.md): Sets the visibility of this group.
- [Get groups reviewers](https://docs.opal.dev/api-reference/groups/get-groups-reviewers.md): Gets the list of owner IDs of the reviewers for a group.
- [Put groups reviewers](https://docs.opal.dev/api-reference/groups/put-groups-reviewers.md): Sets the list of reviewers for a group.
- [Get groups reviewer stages](https://docs.opal.dev/api-reference/groups/get-groups-reviewer-stages.md): Gets the list of reviewer stages for a group.
- [Put groups reviewer stages](https://docs.opal.dev/api-reference/groups/put-groups-reviewer-stages.md): Sets the list of reviewer stages for a group.
- [Get groups tags](https://docs.opal.dev/api-reference/groups/get-groups-tags.md): Returns all tags applied to the group.
- [Get groups users](https://docs.opal.dev/api-reference/groups/get-groups-users.md): Gets the list of users for this group.
- [Put groups users](https://docs.opal.dev/api-reference/groups/put-groups-users.md): Updates a user's access level or duration in this group.
- [Post groups users](https://docs.opal.dev/api-reference/groups/post-groups-users.md): Adds a user to this group.
- [Delete groups users](https://docs.opal.dev/api-reference/groups/delete-groups-users.md): Removes a user's access from this group.
- [Get groupsusers](https://docs.opal.dev/api-reference/groups/get-groupsusers.md): Returns all groups that the user is a member of.
- [Get group bindings](https://docs.opal.dev/api-reference/group-bindings/get-group-bindings.md): Returns a list of `GroupBinding` objects.
- [Put group bindings](https://docs.opal.dev/api-reference/group-bindings/put-group-bindings.md): Bulk updates a list of group bindings.
- [Post group bindings](https://docs.opal.dev/api-reference/group-bindings/post-group-bindings.md): Creates a group binding.
- [Get group binding by ID](https://docs.opal.dev/api-reference/group-bindings/get-group-binding-by-id.md): Returns a `GroupBinding` object.
- [Delete group bindings](https://docs.opal.dev/api-reference/group-bindings/delete-group-bindings.md): Deletes a group binding.
- [Get idp group mappings](https://docs.opal.dev/api-reference/idp-group-mappings/get-idp-group-mappings.md): Returns the configured set of available `IdpGroupMapping` objects for an Okta app.
- [Put idp group mappings](https://docs.opal.dev/api-reference/idp-group-mappings/put-idp-group-mappings.md): Updates the list of available `IdpGroupMapping` objects for an Okta app.
- [Get idp group mappings groups](https://docs.opal.dev/api-reference/idp-group-mappings/get-idp-group-mappings-groups.md): Gets an `IdpGroupMapping` object for an Okta app and group.
- [Post idp group mappings groups](https://docs.opal.dev/api-reference/idp-group-mappings/post-idp-group-mappings-groups.md): Creates or updates an individual `IdpGroupMapping` object (upsert operation).
- [Delete idp group mappings groups](https://docs.opal.dev/api-reference/idp-group-mappings/delete-idp-group-mappings-groups.md): Deletes an `IdpGroupMapping` object.
- [List OpalScripts](https://docs.opal.dev/api-reference/opal-scripts/list-opalscripts.md): Returns the `OpalScript` objects in the caller's organization.
- [Create OpalScript](https://docs.opal.dev/api-reference/opal-scripts/create-opalscript.md): Creates a new `OpalScript`.
- [Get OpalScript by ID](https://docs.opal.dev/api-reference/opal-scripts/get-opalscript-by-id.md): Returns an `OpalScript` object.
- [Update OpalScript](https://docs.opal.dev/api-reference/opal-scripts/update-opalscript.md): Updates an `OpalScript` object.
- [Delete OpalScript](https://docs.opal.dev/api-reference/opal-scripts/delete-opalscript.md): Deletes an `OpalScript`, along with the service user that backs it. A script that is still named as a reviewer, or referenced by a delegation, is rejected until those references are removed.
- [Get OpalScript by name](https://docs.opal.dev/api-reference/opal-scripts/get-opalscript-by-name.md): Returns the `OpalScript` whose name exactly matches the given name. OpalScript names are not unique; when more than one script matches, the request fails and the script must be referenced by ID instead.
- [Get owners](https://docs.opal.dev/api-reference/owners/get-owners.md): Returns a list of `Owner` objects.
- [Put owners](https://docs.opal.dev/api-reference/owners/put-owners.md): Bulk updates a list of owners.
- [Post owners](https://docs.opal.dev/api-reference/owners/post-owners.md): Creates an owner.
- [Get owner by ID](https://docs.opal.dev/api-reference/owners/get-owner-by-id.md): Returns an `Owner` object.
- [Delete owners](https://docs.opal.dev/api-reference/owners/delete-owners.md): Deletes an owner.
- [Get ownersname](https://docs.opal.dev/api-reference/owners/get-ownersname.md): Returns an `Owner` object. Does not support owners with `/` in their name, use /owners?name=... instead.
- [Get owners users](https://docs.opal.dev/api-reference/owners/get-owners-users.md): Gets the list of users for this owner, in escalation priority order if applicable.
- [Put owners users](https://docs.opal.dev/api-reference/owners/put-owners-users.md): Sets the list of users for this owner. If escalation is enabled, the order of this list is the escalation priority order of the users. If the owner has a source group, adding or removing users from this list won't be possible.
- [Get request templates](https://docs.opal.dev/api-reference/request-templates/get-request-templates.md): Returns a list of `RequestTemplate` objects.
- [Put request templates](https://docs.opal.dev/api-reference/request-templates/put-request-templates.md): Updates a request template.
- [Post request templates](https://docs.opal.dev/api-reference/request-templates/post-request-templates.md): Creates a request template.
- [Get request templates 1](https://docs.opal.dev/api-reference/request-templates/get-request-templates-1.md): Returns a `RequestTemplate` object.
- [Delete request templates](https://docs.opal.dev/api-reference/request-templates/delete-request-templates.md): Deletes a request template.
- [Get requests](https://docs.opal.dev/api-reference/requests/get-requests.md): Returns a list of requests for your organization that is visible by the admin.
- [Post requests](https://docs.opal.dev/api-reference/requests/post-requests.md): Create an access request
- [Get requests via Relay](https://docs.opal.dev/api-reference/requests/get-requests-via-relay.md): Returns a paginated list of requests using Relay-style cursor pagination.
- [Get request by ID](https://docs.opal.dev/api-reference/requests/get-request-by-id.md): Returns a request by ID.
- [Post requests approve](https://docs.opal.dev/api-reference/requests/post-requests-approve.md): Approve an access request
- [Post requests deny](https://docs.opal.dev/api-reference/requests/post-requests-deny.md): Deny an access request
- [Cancel request](https://docs.opal.dev/api-reference/requests/cancel-request.md): Cancels a pending access request.
- [Escalate request to skip-manager](https://docs.opal.dev/api-reference/requests/escalate-request-to-skip-manager.md): Escalates a pending access request to the target user's skip-level manager. Only the request's requester may call this endpoint.
- [Send request reminder](https://docs.opal.dev/api-reference/requests/send-request-reminder.md): Sends a reminder to all pending reviewers of the request.
- [Send reminder to a reviewer](https://docs.opal.dev/api-reference/requests/send-reminder-to-a-reviewer.md): Sends a reminder to one pending reviewer of the request.
- [Get requests comments](https://docs.opal.dev/api-reference/requests/get-requests-comments.md): Returns a list of comments for a specific request.
- [Post requests comments](https://docs.opal.dev/api-reference/requests/post-requests-comments.md): Comment on an access request
- [List role assignments](https://docs.opal.dev/api-reference/role-assignments/list-role-assignments.md): Returns a paginated list of role assignments. This endpoint is **admin-only**: the caller's bearer token must belong to a user with the admin or read-only admin role. Non-admin callers receive 403.
- [Add role assignments](https://docs.opal.dev/api-reference/role-assignments/add-role-assignments.md): Grants one or more principals (user, group, or resource) access to one or more entities (resource or group). The request body is batched to match the GraphQL `addRoleAssignments` mutation, which this endpoint thin-wraps. The caller must hold the `EDIT_ASSIGNMENTS` role permission on every entity in…
- [Remove role assignments](https://docs.opal.dev/api-reference/role-assignments/remove-role-assignments.md): Revoke one or more role assignments. Each entry identifies a specific stored grant by the 5-tuple `(entity_id, entity_type, principal_id, principal_type, access_level_remote_id)` — see the field description on `access_level_remote_id` for when it must be supplied and when it must be omitted. The cal…
- [Get resources](https://docs.opal.dev/api-reference/resources/get-resources.md): Returns a list of resources for your organization.
- [Put resources](https://docs.opal.dev/api-reference/resources/put-resources.md): Bulk updates a list of resources.
- [Post resources](https://docs.opal.dev/api-reference/resources/post-resources.md): Creates a resource. See [here](https://docs.opal.dev/reference/end-system-objects) for details about importing resources.
- [Get resource by ID](https://docs.opal.dev/api-reference/resources/get-resource-by-id.md): Retrieves a resource.
- [Delete resources](https://docs.opal.dev/api-reference/resources/delete-resources.md): Deletes a resource.
- [Get the ID of the configuration template linked to a resource](https://docs.opal.dev/api-reference/resources/get-the-id-of-the-configuration-template-linked-to-a-resource.md): Returns the ID of the configuration template that the resource is currently linked to. The response body is `{"configuration_template_id": "<uuid>" | null}`:
- [Set the ID of the configuration template linked to a resource](https://docs.opal.dev/api-reference/resources/set-the-id-of-the-configuration-template-linked-to-a-resource.md): Attaches, repoints, or detaches the configuration template linked to a resource. This endpoint only manages the link (by ID) between a resource and an existing configuration template — it does not create, modify, or delete the template itself. To manage a template's own fields (name, description, re…
- [Get resources message channels](https://docs.opal.dev/api-reference/resources/get-resources-message-channels.md): Gets the list of audit message channels attached to a resource.
- [Put resources message channels](https://docs.opal.dev/api-reference/resources/put-resources-message-channels.md): Sets the list of audit message channels attached to a resource.
- [Get resources visibility](https://docs.opal.dev/api-reference/resources/get-resources-visibility.md): Gets the visibility of this resource.
- [Put resources visibility](https://docs.opal.dev/api-reference/resources/put-resources-visibility.md): Sets the visibility of this resource.
- [Get resources reviewers](https://docs.opal.dev/api-reference/resources/get-resources-reviewers.md): Gets the list of owner IDs of the reviewers for a resource.
- [Put resources reviewers](https://docs.opal.dev/api-reference/resources/put-resources-reviewers.md): Sets the list of reviewers for a resource.
- [Get resources reviewer stages](https://docs.opal.dev/api-reference/resources/get-resources-reviewer-stages.md): Gets the list reviewer stages for a resource.
- [Put resources reviewer stages](https://docs.opal.dev/api-reference/resources/put-resources-reviewer-stages.md): Sets the list of reviewer stages for a resource.
- [Get resources non human identities](https://docs.opal.dev/api-reference/resources/get-resources-non-human-identities.md): Gets the list of non-human identities with access to this resource.
- [Get resource users](https://docs.opal.dev/api-reference/resources/get-resource-users.md): Gets the list of users for this resource.
- [Post resources non human identities](https://docs.opal.dev/api-reference/resources/post-resources-non-human-identities.md): Gives a non-human identity access to this resource.
- [Delete resources non human identities](https://docs.opal.dev/api-reference/resources/delete-resources-non-human-identities.md): Removes a non-human identity's direct access from this resource.
- [Get resource user](https://docs.opal.dev/api-reference/resources/get-resource-user.md): Returns information about a specific user's access to a resource.
- [Put resources users](https://docs.opal.dev/api-reference/resources/put-resources-users.md): Updates a user's access level or duration on this resource.
- [Post resources users](https://docs.opal.dev/api-reference/resources/post-resources-users.md): Adds a user to this resource.
- [Delete resources users](https://docs.opal.dev/api-reference/resources/delete-resources-users.md): Removes a user's direct access from this resource.
- [Get resource user access status ](https://docs.opal.dev/api-reference/resources/get-resource-user-access-status-.md): Get user's access status to a resource.
- [Get resources tags](https://docs.opal.dev/api-reference/resources/get-resources-tags.md): Returns all tags applied to the resource.
- [Get resources scoped role permissions](https://docs.opal.dev/api-reference/resources/get-resources-scoped-role-permissions.md): Returns all the scoped role permissions that apply to the given resource. Only OPAL_SCOPED_ROLE resource type supports this field.
- [Put resources scoped role permissions](https://docs.opal.dev/api-reference/resources/put-resources-scoped-role-permissions.md): Sets all the scoped role permissions on an OPAL_SCOPED_ROLE resource.
- [Get resources custom access levels](https://docs.opal.dev/api-reference/resources/get-resources-custom-access-levels.md): Returns all custom access levels for a resource. If the resource is a parent type (e.g. GitHubOrg), returns aggregated roles across child resources.
- [Post resources custom access levels](https://docs.opal.dev/api-reference/resources/post-resources-custom-access-levels.md): Creates a custom access level on a resource. If the resource is a parent type, the role is created on all child resources.
- [Delete resources custom access levels](https://docs.opal.dev/api-reference/resources/delete-resources-custom-access-levels.md): Deletes a custom access level identified by its remote ID. If the resource is a parent type, the deletion fans out to all child resources.
- [Patch resources custom access levels](https://docs.opal.dev/api-reference/resources/patch-resources-custom-access-levels.md): Updates a custom access level identified by its remote ID. If the resource is a parent type, the update fans out to all child resources.
- [Get resourcesusers](https://docs.opal.dev/api-reference/resources/get-resourcesusers.md): Gets the list of resources for this user.
- [Get resources groups](https://docs.opal.dev/api-reference/resources/get-resources-groups.md): Returns a list of groups that grant access to the resource
- [Get resource access levels](https://docs.opal.dev/api-reference/resources/get-resource-access-levels.md): Returns the list of access levels defined for the resource. Resources that only offer default (unnamed) access return an empty list.
- [Get non human identities](https://docs.opal.dev/api-reference/non-human-identities/get-non-human-identities.md): Returns a list of non-human identities for your organization.
- [Create Paladin](https://docs.opal.dev/api-reference/paladin/create-paladin.md): Creates a new `Paladin`.
- [Get Paladin by ID](https://docs.opal.dev/api-reference/paladin/get-paladin-by-id.md): Returns a `Paladin` object.
- [Update Paladin](https://docs.opal.dev/api-reference/paladin/update-paladin.md): Updates a `Paladin` object.
- [Delete Paladin](https://docs.opal.dev/api-reference/paladin/delete-paladin.md): Deletes a Paladin, removing the underlying service user.
- [Get Paladins by name](https://docs.opal.dev/api-reference/paladin/get-paladins-by-name.md): Returns all Paladins whose name exactly matches the given name. Names are not unique, so the result is a list and may be empty.
- [List Paladin context sources](https://docs.opal.dev/api-reference/paladin/list-paladin-context-sources.md): Returns the context sources (Slack channels and documents) configured for a Paladin.
- [Add a Paladin context source](https://docs.opal.dev/api-reference/paladin/add-a-paladin-context-source.md): Configures a context source (a Slack channel or a document) for a Paladin to read. Idempotent, so re-adding an existing source returns it.
- [Remove a Paladin context source](https://docs.opal.dev/api-reference/paladin/remove-a-paladin-context-source.md): Removes a context source from a Paladin.
- [Create service user](https://docs.opal.dev/api-reference/service-users/create-service-user.md): Creates a new service user (a non-human identity owned by a team). Mirrors the GraphQL `createServiceUser` mutation; admin-only.
- [Get sessions](https://docs.opal.dev/api-reference/sessions/get-sessions.md): Returns a list of `Session` objects.
- [Get user](https://docs.opal.dev/api-reference/users/get-user.md): Returns a `User` object.
- [Get users](https://docs.opal.dev/api-reference/users/get-users.md): Returns a list of users for your organization. Includes agent-labeled identities that appear on the Users page. Classic service accounts are not included.
- [Post users](https://docs.opal.dev/api-reference/users/post-users.md): Invites a user to your organization.
- [Get user by ID](https://docs.opal.dev/api-reference/users/get-user-by-id.md): Returns a `User` object.
- [Delete users](https://docs.opal.dev/api-reference/users/delete-users.md): Deletes a user from your organization.
- [Patch users](https://docs.opal.dev/api-reference/users/patch-users.md): Updates a user's position or manager.
- [Reset a user's Opal MFA](https://docs.opal.dev/api-reference/users/reset-a-users-opal-mfa.md): Deletes the user's Auth0 (Opal) MFA enrollments so they are prompted to re-enroll on their next sign-in. Only applies to orgs that use Opal/Auth0 for MFA (not available on-prem, and a no-op success for users who have never signed into Auth0).
- [Get usersremote users](https://docs.opal.dev/api-reference/users/get-usersremote_users.md): Returns a list of remote users for your organization.
- [Get userswhoami](https://docs.opal.dev/api-reference/users/get-userswhoami.md): Returns the user that the provided API token authenticates as.
- [Get users tags](https://docs.opal.dev/api-reference/users/get-users-tags.md): Returns all tags applied to the user.
- [Get access rules](https://docs.opal.dev/api-reference/access-rules/get-access-rules.md): Returns a list of access rules for your organization.
- [Post access rules](https://docs.opal.dev/api-reference/access-rules/post-access-rules.md): Creates a new access rule config for the given group_id.
- [Get access rules 1](https://docs.opal.dev/api-reference/access-rules/get-access-rules-1.md): Returns a list of access rule config given the group_id of the access rule.
- [Put access rules](https://docs.opal.dev/api-reference/access-rules/put-access-rules.md): Updates the access rule config for the given group_id.
- [Get tag by ID](https://docs.opal.dev/api-reference/tags/get-tag-by-id.md): UNSTABLE. May be removed at any time. Gets a tag with the given id.
- [Delete tag](https://docs.opal.dev/api-reference/tags/delete-tag.md): UNSTABLE. May be removed at any time. Deletes a tag with the given id.
- [Get tag](https://docs.opal.dev/api-reference/tags/get-tag.md): Gets a tag with the given key and value.
- [Post tag](https://docs.opal.dev/api-reference/tags/post-tag.md): Creates a tag with the given key and value.
- [Get tags](https://docs.opal.dev/api-reference/tags/get-tags.md): Returns a list of tags created by your organization.
- [Post tags users](https://docs.opal.dev/api-reference/tags/post-tags-users.md): Applies a tag to a user.
- [Delete tags users](https://docs.opal.dev/api-reference/tags/delete-tags-users.md): Removes a tag from a user.
- [Post tags groups](https://docs.opal.dev/api-reference/tags/post-tags-groups.md): Applies a tag to a group.
- [Delete tags groups](https://docs.opal.dev/api-reference/tags/delete-tags-groups.md): Removes a tag from a group.
- [Post tags resources](https://docs.opal.dev/api-reference/tags/post-tags-resources.md): Applies a tag to a resource.
- [Delete tags resources](https://docs.opal.dev/api-reference/tags/delete-tags-resources.md): Removes a tag from a resource.
- [Get message channels](https://docs.opal.dev/api-reference/message-channels/get-message-channels.md): Returns a list of `MessageChannel` objects.
- [Post message channels](https://docs.opal.dev/api-reference/message-channels/post-message-channels.md): Creates a `MessageChannel` objects.
- [Get message channel by ID](https://docs.opal.dev/api-reference/message-channels/get-message-channel-by-id.md): Gets a `MessageChannel` object.
- [Get on call schedules](https://docs.opal.dev/api-reference/on-call-schedules/get-on-call-schedules.md): Returns a list of `OnCallSchedule` objects.
- [Post on call schedules](https://docs.opal.dev/api-reference/on-call-schedules/post-on-call-schedules.md): Creates a `OnCallSchedule` objects.
- [Get on call schedule by ID](https://docs.opal.dev/api-reference/on-call-schedules/get-on-call-schedule-by-id.md): Gets a `OnCallSchedule` object.
- [Run an ad-hoc OpalQuery](https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery.md): Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a **Node** query filters and returns entities (users, resources, or groups); an **Access** query returns the access grants between principals and their entitlements, one per (principal, entitlement, access lev…
- [Get tokens](https://docs.opal.dev/api-reference/tokens/get-tokens.md): Returns a list of first-party API tokens for your organization. Requires admin access.
- [Create token](https://docs.opal.dev/api-reference/tokens/create-token.md): Creates a first-party API token. Omit `user_id` (or set it to the caller's ID) to create a token for yourself. Set `user_id` to a service user's ID to mint a token that authenticates as that service user. Creating a token for another human user is not allowed.
- [Delete token](https://docs.opal.dev/api-reference/tokens/delete-token.md): Deletes a first-party API token. Admins can delete any token. Non-admins can only delete their own tokens when the organization allows all users to create API tokens.
- [Get uars](https://docs.opal.dev/api-reference/uars/get-uars.md): Returns a list of `UAR` objects. Deprecated in favor of `GET /campaigns`.
- [Post uar](https://docs.opal.dev/api-reference/uars/post-uar.md): Starts a User Access Review. Deprecated in favor of `POST /campaigns`.
- [Get uar](https://docs.opal.dev/api-reference/uars/get-uar.md): Retrieves a specific UAR. Deprecated in favor of `GET /campaigns/{campaign_id}`.
- [Get delegations](https://docs.opal.dev/api-reference/delegations/get-delegations.md): Returns a list of request reviewer delegations configured for your organization.
- [Post delegations](https://docs.opal.dev/api-reference/delegations/post-delegations.md): Creates a new request reviewer delegation to delegate access review requests from one user to another.
- [Get delegation by ID](https://docs.opal.dev/api-reference/delegations/get-delegation-by-id.md): Returns a specific delegation by its ID.
- [Delete delegations](https://docs.opal.dev/api-reference/delegations/delete-delegations.md): Deletes a delegation by its ID.
- [Changelog](https://docs.opal.dev/changelog/changelog.md): Product updates and announcements
- [CLI Changelog](https://docs.opal.dev/changelog/cli-changelog.md): Learn about notable changes to the Opal CLI.

## OpenAPI Specs

- [openapi](https://app.opal.dev/openapi.yaml)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.