Describe a Ruleset

curl --request GET \
  --url https://wksusa1b2c3d.provisionr.app/api/v1/policy/rulesets/{ruleset} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://wksusa1b2c3d.provisionr.app/api/v1/policy/rulesets/{ruleset}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://wksusa1b2c3d.provisionr.app/api/v1/policy/rulesets/{ruleset}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "id": "poset_01hq8xyzabc123def456ghi789",
  "state": "unmanaged",
  "resource_type": "directory_attribute",
  "resource_id": "dratr_01hq8xyzabc123def456ghi789",
  "resource_parent": "Department",
  "resource_name": "Engineering",
  "resource_handle": "eng",
  "is_authoritative": false,
  "expires_after_days": 30,
  "count": {
    "policy_ruleset_admins": 123,
    "policy_conditions": 123,
    "policy_rules": 123,
    "manifest_users": 123,
    "qualified_users": 123,
    "staged_users": 123,
    "audit_logs_parent": 123,
    "audit_logs_record": 123,
    "audit_logs_related": 123
  },
  "included": {
    "policy_resource": "<unknown>",
    "policy_ruleset_admins": [
      {
        "id": "posaa_01hq8xyzabc123def456ghi789",
        "state": "staged",
        "role": "admin",
        "timestamp": {
          "created_at": "2025-01-28T13:37:00Z",
          "updated_at": "2025-05-04T03:27:00Z",
          "activated_at": "2025-03-14T15:07:00Z",
          "expires_at": null,
          "deleted_at": null
        },
        "included": {
          "directory_user": {
            "id": "drusr_01hq8xyzabc123def456ghi789",
            "state": "active",
            "manager_id": "drusr_01kam9z5z71f7r4hhrm2ydxkhn",
            "is_manager": true,
            "full_name": "Dade Murphy",
            "email": "[email protected]",
            "username": "dmurphy",
            "badge_id": "<string>",
            "employee_id": "<string>",
            "employee_alt_id": "<string>",
            "org": {
              "cost_center": "CC-1234",
              "department": "Infrastructure",
              "division": "Engineering",
              "title": "Senior Engineer"
            },
            "metadata": {
              "custom_field_1": "value1",
              "employee_type": "full-time",
              "desk_number": "42"
            }
          },
          "policy_ruleset": {
            "id": "poset_01hq8xyzabc123def456ghi789",
            "state": "unmanaged",
            "type": "directory_attribute",
            "resource_id": "dratr_01hq8xyzabc123def456ghi789",
            "is_authoritative": false,
            "expires_after_days": 30
          }
        },
        "links": {
          "self": "<string>",
          "directory_user": "<string>",
          "policy_ruleset": "<string>"
        }
      }
    ],
    "policy_rules": [
      {
        "id": "porul_01hq8xyzabc123def456ghi789",
        "state": "active",
        "role_name": "Group Member",
        "role_handle": "member",
        "is_imported": true,
        "description": "<string>",
        "expires_after_days": 123,
        "expires_after_days_inherited": true,
        "priority": 42
      }
    ],
    "policy_conditions": [
      {
        "id": "pocon_01hq8xyzabc123def456ghi789",
        "is_imported": true,
        "type": "attribute",
        "ruleset_id": "poset_01hq8xyzabc123def456ghi789",
        "rule_id": "porul_01hq8xyzabc123def456ghi789",
        "resource_id": "dratr_01hq8xyzabc123def456ghi789",
        "profile_key": "department",
        "profile_operator": "equals",
        "profile_value": "IT Helpdesk",
        "description": "<string>"
      }
    ]
  },
  "links": {
    "self": "<string>",
    "policy_resource": "<string>",
    "policy_ruleset_admins": "<string>",
    "policy_rules": "<string>",
    "policy_conditions": "<string>",
    "manifest_users": "<string>",
    "qualified_users": "<string>",
    "staged_users": "<string>",
    "audit_logs_parent": "<string>",
    "audit_logs_record": "<string>",
    "audit_logs_related": "<string>"
  }
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

GET

policy

rulesets

{ruleset}

Describe a Ruleset

curl --request GET \
  --url https://wksusa1b2c3d.provisionr.app/api/v1/policy/rulesets/{ruleset} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://wksusa1b2c3d.provisionr.app/api/v1/policy/rulesets/{ruleset}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://wksusa1b2c3d.provisionr.app/api/v1/policy/rulesets/{ruleset}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "id": "poset_01hq8xyzabc123def456ghi789",
  "state": "unmanaged",
  "resource_type": "directory_attribute",
  "resource_id": "dratr_01hq8xyzabc123def456ghi789",
  "resource_parent": "Department",
  "resource_name": "Engineering",
  "resource_handle": "eng",
  "is_authoritative": false,
  "expires_after_days": 30,
  "count": {
    "policy_ruleset_admins": 123,
    "policy_conditions": 123,
    "policy_rules": 123,
    "manifest_users": 123,
    "qualified_users": 123,
    "staged_users": 123,
    "audit_logs_parent": 123,
    "audit_logs_record": 123,
    "audit_logs_related": 123
  },
  "included": {
    "policy_resource": "<unknown>",
    "policy_ruleset_admins": [
      {
        "id": "posaa_01hq8xyzabc123def456ghi789",
        "state": "staged",
        "role": "admin",
        "timestamp": {
          "created_at": "2025-01-28T13:37:00Z",
          "updated_at": "2025-05-04T03:27:00Z",
          "activated_at": "2025-03-14T15:07:00Z",
          "expires_at": null,
          "deleted_at": null
        },
        "included": {
          "directory_user": {
            "id": "drusr_01hq8xyzabc123def456ghi789",
            "state": "active",
            "manager_id": "drusr_01kam9z5z71f7r4hhrm2ydxkhn",
            "is_manager": true,
            "full_name": "Dade Murphy",
            "email": "[email protected]",
            "username": "dmurphy",
            "badge_id": "<string>",
            "employee_id": "<string>",
            "employee_alt_id": "<string>",
            "org": {
              "cost_center": "CC-1234",
              "department": "Infrastructure",
              "division": "Engineering",
              "title": "Senior Engineer"
            },
            "metadata": {
              "custom_field_1": "value1",
              "employee_type": "full-time",
              "desk_number": "42"
            }
          },
          "policy_ruleset": {
            "id": "poset_01hq8xyzabc123def456ghi789",
            "state": "unmanaged",
            "type": "directory_attribute",
            "resource_id": "dratr_01hq8xyzabc123def456ghi789",
            "is_authoritative": false,
            "expires_after_days": 30
          }
        },
        "links": {
          "self": "<string>",
          "directory_user": "<string>",
          "policy_ruleset": "<string>"
        }
      }
    ],
    "policy_rules": [
      {
        "id": "porul_01hq8xyzabc123def456ghi789",
        "state": "active",
        "role_name": "Group Member",
        "role_handle": "member",
        "is_imported": true,
        "description": "<string>",
        "expires_after_days": 123,
        "expires_after_days_inherited": true,
        "priority": 42
      }
    ],
    "policy_conditions": [
      {
        "id": "pocon_01hq8xyzabc123def456ghi789",
        "is_imported": true,
        "type": "attribute",
        "ruleset_id": "poset_01hq8xyzabc123def456ghi789",
        "rule_id": "porul_01hq8xyzabc123def456ghi789",
        "resource_id": "dratr_01hq8xyzabc123def456ghi789",
        "profile_key": "department",
        "profile_operator": "equals",
        "profile_value": "IT Helpdesk",
        "description": "<string>"
      }
    ]
  },
  "links": {
    "self": "<string>",
    "policy_resource": "<string>",
    "policy_ruleset_admins": "<string>",
    "policy_rules": "<string>",
    "policy_conditions": "<string>",
    "manifest_users": "<string>",
    "qualified_users": "<string>",
    "staged_users": "<string>",
    "audit_logs_parent": "<string>",
    "audit_logs_record": "<string>",
    "audit_logs_related": "<string>"
  }
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

ruleset

string

required

Policy Ruleset ID

Query Parameters

include

enum<string>[]

Available options:

ruleset-users,

ruleset-users-count,

ruleset-users-exists,

manifest-users,

manifest-users-count,

manifest-users-exists,

qualified-users,

qualified-users-count,

qualified-users-exists

filter

string

Response

PolicyRulesetDetailedResponseData

string

required

Example:

"poset_01hq8xyzabc123def456ghi789"

state

enum<string>

required

The state of the policy ruleset and whether the group or resource is being managed


`unmanaged` The Workspace Integration sync detected this existing group or resource. Until you change the ruleset to `monitored` or `managed`, Provisionr simply sees that it exists but will not perform API calls to detect users. No rules or conditions can be created until a ruleset is changed to `managed`. Any unmanaged groups and resources are hidden from most user interfaces to reduce clutter. An unmanaged ruleset is not counted as an active policy for billing purposes.
`monitored` The Workspace Integration sync is performing read-only monitoring for this group or resource to detect changes, however no API calls are made to add or remove users. This allows you to see an audit trail of changes in user membership over time without managing rules and conditions. Recommendations for rules and conditions will still be generated based on user membership changes for insights. You can change the ruleset to `managed` to start creating rules and conditions. A monitored ruleset does count as an active policy for billing purposes.
`managed` The Workspace Integration sync is actively managing this group or resource and provisioning and deprovisioning users based on the rules and conditions defined. By default, `is_authoritative` is set to false. Administrators can create rules and conditions to manage users, however any unmanaged group or resource users detected during syncs are ignored (not removed). If `is_authoritative` is set to true, any unmanaged users detected during syncs are removed from the group or resource. The Provisionr database maintains a record of them for auditing purposes and ability to restore them later if needed. A managed ruleset does count as an active policy for billing purposes.
`deactivated` The ruleset was deactivated manually by an administrator.

Available options:

unmanaged,

monitored,

managed,

deactivated

resource_type

enum<string>

required

The type of resource that this policy ruleset applies to


`directory_attribute` Provisionr Dimension Attribute. This acts as a reusable ruleset for other Attributes, Groups or Resources
`google_workspace_group` Google Workspace Group. This is used for Workspace Groups that can be used for email distribution lists and access management.
`okta_group` Okta Group. This is used for managing members of a group that is assigned to one or more to Okta Apps.

Available options:

directory_attribute,

google_workspace_group,

okta_group

Example:

"directory_attribute"

resource_id

string

required

The ID of the resource that this policy ruleset applies to

Examples:

"dratr_01hq8xyzabc123def456ghi789"

"glgrp_01hq8xyzabc123def456ghi789"

"glprj_01hq8xyzabc123def456ghi789"

"gddoc_01hq8xyzabc123def456ghi789"

"gdfil_01hq8xyzabc123def456ghi789"

"gdfol_01hq8xyzabc123def456ghi789"

"gddck_01hq8xyzabc123def456ghi789"

"gdsht_01hq8xyzabc123def456ghi789"

"gigrp_01hq8xyzabc123def456ghi789"

"gwdrv_01hq8xyzabc123def456ghi789"

"gwgrp_01hq8xyzabc123def456ghi789"

"okgrp_01hq8xyzabc123def456ghi789"

"slgrp_01hq8xyzabc123def456ghi789"

"slprv_01hq8xyzabc123def456ghi789"

"slpub_01hq8xyzabc123def456ghi789"

resource_parent

string

required

The parent name of the resource that this policy ruleset applies to

Example:

"Department"

resource_name

string

required

The name of the resource that this policy ruleset applies to

Example:

"Engineering"

resource_handle

string

required

The handle of the resource that this policy ruleset applies to

Example:

"eng"

is_authoritative

boolean

required

Whether this ruleset is authoritative for managing users on the resource. If true, only users that match a Provisionr policy rule will remain a member of the group or resource, and unmanaged users will be removed during each sync. If false, users added outside of Provisionr will not be removed

Example:

false

expires_after_days

integer

required

This shows the value for the parent attribute or resource.

Users will be automatically deprecated if they no longer qualify for at least one rule in the ruleset.

The expires_after_days value determines how many days after they no longer qualify that they still have access for a graceful transition period when users change job roles.

The value is inherited from the Workspace > Dimension > Ruleset > Rule and can be overridden at any level to provide shorter revoke time controls when needed.

If the value is 0, this skips the grace period and revokes access immediately after expires_at

Example:

30

count

object

required

Counts of related resources

Show child attributes

included

object

required

Included related resources

Show child attributes

links

object

required

API hyperlinks related to the policy ruleset record

Show child attributes

Getting Started

Endpoints

Describe a Ruleset

Authorizations

Path Parameters

Query Parameters

Response