Get Effective Session Policy
curl --request GET \
--url https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy \
--header 'Authorization: Bearer <token>'import requests
url = "https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"group": {
"alias": "<string>",
"annotations": {},
"appId": "<string>",
"appResourceId": "<string>",
"appResourceTypeId": "<string>",
"certifyPolicyId": "<string>",
"complianceFrameworkValueIds": [
"<string>"
],
"createdAt": "2023-11-07T05:31:56Z",
"defaultValuesApplied": true,
"deletedAt": "2023-11-07T05:31:56Z",
"deprovisionerPolicy": {
"action": {
"actionName": "<string>",
"appId": "<string>",
"connectorId": "<string>",
"displayName": "<string>"
},
"connector": {
"account": {
"config": {},
"connectorId": "<string>",
"doNotSave": {},
"saveToVault": {
"vaultIds": [
"<string>"
]
},
"schemaId": "<string>"
},
"defaultBehavior": {
"connectorId": "<string>"
},
"deleteAccount": {
"connectorId": "<string>"
}
},
"delegated": {
"appId": "<string>",
"entitlementId": "<string>",
"implicit": true
},
"devicePlacement": {
"vaultBoundaryId": "<string>"
},
"externalTicket": {
"appId": "<string>",
"connectorId": "<string>",
"externalTicketProvisionerConfigId": "<string>",
"instructions": "<string>"
},
"manual": {
"assignee": {
"appOwners": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"entitlementOwners": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"expression": {
"allowReassignment": true,
"expressions": [
"<string>"
],
"fallbackUserIds": [
"<string>"
]
},
"group": {
"allowReassignment": true,
"appGroupId": "<string>",
"appId": "<string>",
"fallbackUserIds": [
"<string>"
]
},
"manager": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"users": {
"allowReassignment": true,
"userIds": [
"<string>"
]
}
},
"instructions": "<string>",
"userIds": [
"<string>"
]
},
"multiStep": {
"provisionSteps": "<array>"
},
"unconfigured": {},
"webhook": {
"webhookId": "<string>"
}
},
"description": "<string>",
"displayName": "<string>",
"durationGrant": "<string>",
"durationUnset": {},
"emergencyGrantEnabled": true,
"emergencyGrantPolicyId": "<string>",
"externalId": "<string>",
"grantCount": "<string>",
"grantPolicyId": "<string>",
"id": "<string>",
"isAutomationEnabled": true,
"isManuallyManaged": true,
"matchBatonId": "<string>",
"overrideAccessRequestsDefaults": true,
"provisionerPolicy": {
"action": {
"actionName": "<string>",
"appId": "<string>",
"connectorId": "<string>",
"displayName": "<string>"
},
"connector": {
"account": {
"config": {},
"connectorId": "<string>",
"doNotSave": {},
"saveToVault": {
"vaultIds": [
"<string>"
]
},
"schemaId": "<string>"
},
"defaultBehavior": {
"connectorId": "<string>"
},
"deleteAccount": {
"connectorId": "<string>"
}
},
"delegated": {
"appId": "<string>",
"entitlementId": "<string>",
"implicit": true
},
"devicePlacement": {
"vaultBoundaryId": "<string>"
},
"externalTicket": {
"appId": "<string>",
"connectorId": "<string>",
"externalTicketProvisionerConfigId": "<string>",
"instructions": "<string>"
},
"manual": {
"assignee": {
"appOwners": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"entitlementOwners": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"expression": {
"allowReassignment": true,
"expressions": [
"<string>"
],
"fallbackUserIds": [
"<string>"
]
},
"group": {
"allowReassignment": true,
"appGroupId": "<string>",
"appId": "<string>",
"fallbackUserIds": [
"<string>"
]
},
"manager": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"users": {
"allowReassignment": true,
"userIds": [
"<string>"
]
}
},
"instructions": "<string>",
"userIds": [
"<string>"
]
},
"multiStep": {
"provisionSteps": "<array>"
},
"unconfigured": {},
"webhook": {
"webhookId": "<string>"
}
},
"purpose": "APP_ENTITLEMENT_PURPOSE_VALUE_UNSPECIFIED",
"requestSchemaId": "<string>",
"revokePolicyId": "<string>",
"riskLevelValueId": "<string>",
"slug": "<string>",
"sourceConnectorIds": {},
"systemBuiltin": true,
"updatedAt": "2023-11-07T05:31:56Z",
"userEditedMask": "<string>"
},
"sessionPolicy": {
"accessTokenTtlSeconds": 123,
"continuousDefaultOutcome": {
"allow": {
"floorLevel": "AUTH_LEVEL_UNSPECIFIED"
},
"challengeRequired": {
"types": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
},
"deny": {
"reasonAdmin": "<string>",
"reasonUser": "<string>"
},
"enrollmentRequired": {
"credentialTypes": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
},
"stepUpRequired": {
"level": "AUTH_LEVEL_UNSPECIFIED",
"maxAgeSeconds": 123,
"types": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
}
},
"continuousRules": [
{
"description": "<string>",
"id": "<string>",
"matchCel": "<string>",
"mode": "POLICY_RULE_MODE_UNSPECIFIED",
"outcome": {
"allow": {
"floorLevel": "AUTH_LEVEL_UNSPECIFIED"
},
"challengeRequired": {
"types": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
},
"deny": {
"reasonAdmin": "<string>",
"reasonUser": "<string>"
},
"enrollmentRequired": {
"credentialTypes": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
},
"stepUpRequired": {
"level": "AUTH_LEVEL_UNSPECIFIED",
"maxAgeSeconds": 123,
"types": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
}
}
}
],
"createdAt": "2023-11-07T05:31:56Z",
"credentialDurations": [
{
"accessTokenTtlSeconds": 123,
"credentialType": "CREDENTIAL_TYPE_UNSPECIFIED",
"maxSessionDurationSeconds": 123
}
],
"deletedAt": "2023-11-07T05:31:56Z",
"displayName": "<string>",
"id": "<string>",
"idleTimeoutSeconds": 123,
"isBuiltin": true,
"maxSessionDurationSeconds": 123,
"persistence": "PERSISTENCE_MODE_UNSPECIFIED",
"priority": 123,
"refreshRotationWindowSeconds": 123,
"refreshTokenTtlSeconds": 123,
"rotateRefreshOnUse": true,
"ssfReceive": {
"enabled": true,
"ssfReceiverStreamIds": [
"<string>"
]
},
"ssfTransmit": {
"enabled": true,
"eventTypes": [
"<string>"
],
"ssfTransmitterStreamIds": [
"<string>"
]
},
"updatedAt": "2023-11-07T05:31:56Z"
},
"source": "EFFECTIVE_SESSION_POLICY_SOURCE_UNSPECIFIED"
}Session Policy
Get Effective Session Policy
Returns the single effective session policy for a user and why it applies: the assigned policy with the highest priority, else the tenant default, else none. Read-only and diagnostic: it reflects current assignment state rather than the resolver’s cached resolution.
GET
/
api
/
v1
/
users
/
{user_id}
/
effective-session-policy
Get Effective Session Policy
curl --request GET \
--url https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy \
--header 'Authorization: Bearer <token>'import requests
url = "https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenantDomain}.conductor.one/api/v1/users/{user_id}/effective-session-policy")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"group": {
"alias": "<string>",
"annotations": {},
"appId": "<string>",
"appResourceId": "<string>",
"appResourceTypeId": "<string>",
"certifyPolicyId": "<string>",
"complianceFrameworkValueIds": [
"<string>"
],
"createdAt": "2023-11-07T05:31:56Z",
"defaultValuesApplied": true,
"deletedAt": "2023-11-07T05:31:56Z",
"deprovisionerPolicy": {
"action": {
"actionName": "<string>",
"appId": "<string>",
"connectorId": "<string>",
"displayName": "<string>"
},
"connector": {
"account": {
"config": {},
"connectorId": "<string>",
"doNotSave": {},
"saveToVault": {
"vaultIds": [
"<string>"
]
},
"schemaId": "<string>"
},
"defaultBehavior": {
"connectorId": "<string>"
},
"deleteAccount": {
"connectorId": "<string>"
}
},
"delegated": {
"appId": "<string>",
"entitlementId": "<string>",
"implicit": true
},
"devicePlacement": {
"vaultBoundaryId": "<string>"
},
"externalTicket": {
"appId": "<string>",
"connectorId": "<string>",
"externalTicketProvisionerConfigId": "<string>",
"instructions": "<string>"
},
"manual": {
"assignee": {
"appOwners": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"entitlementOwners": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"expression": {
"allowReassignment": true,
"expressions": [
"<string>"
],
"fallbackUserIds": [
"<string>"
]
},
"group": {
"allowReassignment": true,
"appGroupId": "<string>",
"appId": "<string>",
"fallbackUserIds": [
"<string>"
]
},
"manager": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"users": {
"allowReassignment": true,
"userIds": [
"<string>"
]
}
},
"instructions": "<string>",
"userIds": [
"<string>"
]
},
"multiStep": {
"provisionSteps": "<array>"
},
"unconfigured": {},
"webhook": {
"webhookId": "<string>"
}
},
"description": "<string>",
"displayName": "<string>",
"durationGrant": "<string>",
"durationUnset": {},
"emergencyGrantEnabled": true,
"emergencyGrantPolicyId": "<string>",
"externalId": "<string>",
"grantCount": "<string>",
"grantPolicyId": "<string>",
"id": "<string>",
"isAutomationEnabled": true,
"isManuallyManaged": true,
"matchBatonId": "<string>",
"overrideAccessRequestsDefaults": true,
"provisionerPolicy": {
"action": {
"actionName": "<string>",
"appId": "<string>",
"connectorId": "<string>",
"displayName": "<string>"
},
"connector": {
"account": {
"config": {},
"connectorId": "<string>",
"doNotSave": {},
"saveToVault": {
"vaultIds": [
"<string>"
]
},
"schemaId": "<string>"
},
"defaultBehavior": {
"connectorId": "<string>"
},
"deleteAccount": {
"connectorId": "<string>"
}
},
"delegated": {
"appId": "<string>",
"entitlementId": "<string>",
"implicit": true
},
"devicePlacement": {
"vaultBoundaryId": "<string>"
},
"externalTicket": {
"appId": "<string>",
"connectorId": "<string>",
"externalTicketProvisionerConfigId": "<string>",
"instructions": "<string>"
},
"manual": {
"assignee": {
"appOwners": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"entitlementOwners": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"expression": {
"allowReassignment": true,
"expressions": [
"<string>"
],
"fallbackUserIds": [
"<string>"
]
},
"group": {
"allowReassignment": true,
"appGroupId": "<string>",
"appId": "<string>",
"fallbackUserIds": [
"<string>"
]
},
"manager": {
"allowReassignment": true,
"fallbackUserIds": [
"<string>"
]
},
"users": {
"allowReassignment": true,
"userIds": [
"<string>"
]
}
},
"instructions": "<string>",
"userIds": [
"<string>"
]
},
"multiStep": {
"provisionSteps": "<array>"
},
"unconfigured": {},
"webhook": {
"webhookId": "<string>"
}
},
"purpose": "APP_ENTITLEMENT_PURPOSE_VALUE_UNSPECIFIED",
"requestSchemaId": "<string>",
"revokePolicyId": "<string>",
"riskLevelValueId": "<string>",
"slug": "<string>",
"sourceConnectorIds": {},
"systemBuiltin": true,
"updatedAt": "2023-11-07T05:31:56Z",
"userEditedMask": "<string>"
},
"sessionPolicy": {
"accessTokenTtlSeconds": 123,
"continuousDefaultOutcome": {
"allow": {
"floorLevel": "AUTH_LEVEL_UNSPECIFIED"
},
"challengeRequired": {
"types": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
},
"deny": {
"reasonAdmin": "<string>",
"reasonUser": "<string>"
},
"enrollmentRequired": {
"credentialTypes": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
},
"stepUpRequired": {
"level": "AUTH_LEVEL_UNSPECIFIED",
"maxAgeSeconds": 123,
"types": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
}
},
"continuousRules": [
{
"description": "<string>",
"id": "<string>",
"matchCel": "<string>",
"mode": "POLICY_RULE_MODE_UNSPECIFIED",
"outcome": {
"allow": {
"floorLevel": "AUTH_LEVEL_UNSPECIFIED"
},
"challengeRequired": {
"types": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
},
"deny": {
"reasonAdmin": "<string>",
"reasonUser": "<string>"
},
"enrollmentRequired": {
"credentialTypes": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
},
"stepUpRequired": {
"level": "AUTH_LEVEL_UNSPECIFIED",
"maxAgeSeconds": 123,
"types": [
"CREDENTIAL_TYPE_UNSPECIFIED"
]
}
}
}
],
"createdAt": "2023-11-07T05:31:56Z",
"credentialDurations": [
{
"accessTokenTtlSeconds": 123,
"credentialType": "CREDENTIAL_TYPE_UNSPECIFIED",
"maxSessionDurationSeconds": 123
}
],
"deletedAt": "2023-11-07T05:31:56Z",
"displayName": "<string>",
"id": "<string>",
"idleTimeoutSeconds": 123,
"isBuiltin": true,
"maxSessionDurationSeconds": 123,
"persistence": "PERSISTENCE_MODE_UNSPECIFIED",
"priority": 123,
"refreshRotationWindowSeconds": 123,
"refreshTokenTtlSeconds": 123,
"rotateRefreshOnUse": true,
"ssfReceive": {
"enabled": true,
"ssfReceiverStreamIds": [
"<string>"
]
},
"ssfTransmit": {
"enabled": true,
"eventTypes": [
"<string>"
],
"ssfTransmitterStreamIds": [
"<string>"
]
},
"updatedAt": "2023-11-07T05:31:56Z"
},
"source": "EFFECTIVE_SESSION_POLICY_SOURCE_UNSPECIFIED"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.
Path Parameters
The user whose effective session policy to resolve.
Response
200 - application/json
SessionPolicyServiceGetEffectiveSessionPolicyResponse carries the effective policy and why it applies.
SessionPolicyServiceGetEffectiveSessionPolicyResponse carries the effective policy and why it applies.
The app entitlement represents one permission in a downstream App (SAAS) that can be granted. For example, GitHub Read vs GitHub Write.
This message contains a oneof named max_grant_duration. Only a single field of the following list may be set at a time:
- durationUnset
- durationGrant
Show child attributes
Show child attributes
SessionPolicy defines session lifetime and continuous-evaluation behavior.
Show child attributes
Show child attributes
Why the policy applies.
Available options:
EFFECTIVE_SESSION_POLICY_SOURCE_UNSPECIFIED, EFFECTIVE_SESSION_POLICY_SOURCE_DIRECT, EFFECTIVE_SESSION_POLICY_SOURCE_GROUP, EFFECTIVE_SESSION_POLICY_SOURCE_TENANT_DEFAULT, EFFECTIVE_SESSION_POLICY_SOURCE_TENANT_DEFAULT_NONE Was this page helpful?