Details for Organization Management
This topic covers details for writing policies to control access to Organization Management.
Resource-Types
organizations-familyorganizations-linkorganizations-recipient-invitationorganizations-sender-invitationorganizations-invitationorganizations-domainorganizations-domain-governanceorganizations-entityorganizations-tenancyorganizations-orderorganizations-subscriptionorganizations-subscription-mappingorganizations-assigned-subscriptionorganizations-subscription-regionorganizations-governance-rulesorganizations-enforced-governance-rules
Supported Variables
Organization Management supports all the general variables (see General Variables for All Requests), plus additional ones listed here:
Required variables (supplied by service for every request):
| Variable | Variable Type | Comments |
|---|---|---|
target.resource.kind |
String | The resource kind name of the primary resource for the request. |
Automatic Variables (supplied by the SDK for every request):
| Variable | Variable Type | Comments |
|---|---|---|
target.tenant.id |
Entity (OCID) | The OCID of the target tenant ID. |
Details for Verb + Resource-Type Combinations
The following tables show the permissions and API operations covered by each verb. The level of access is cumulative as you go from inspect > read > use > manage. For example, a group that can use a resource can also inspect and read that resource. A plus sign (+) in a table cell indicates incremental access compared to the cell directly above it, whereas "no extra" indicates no incremental access.
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_LINK_INSPECT ORGANIZATIONS_RECIPIENT_INVITATION_INSPECT ORGANIZATIONS_SENDER_INVITATION_INSPECT ORGANIZATIONS_DOMAIN_INSPECT ORGANIZATIONS_DOMAIN_GOVERNANCE_INSPECT ORGANIZATIONS_TENANCY_INSPECT ORGANIZATIONS_SUBSCRIPTION_INSPECT ORGANIZATIONS_SUBSCRIPTION_MAPPING_INSPECT ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_INSPECT ORGANIZATIONS_SUBSCRIPTION_REGION_INSPECT GOVERNANCE_RULE_INSPECT ORGANIZATIONS_ENTITY_INSPECT ORGANIZATIONS_TENANCY_INSPECT |
ListLinks
|
none |
| READ | INSPECT + ORGANIZATIONS_LINK_READ ORGANIZATIONS_RECIPIENT_INVITATION_READ ORGANIZATIONS_SENDER_INVITATION_READ ORGANIZATIONS_DOMAIN_READ ORGANIZATIONS_DOMAIN_GOVERNANCE_READ ORGANIZATIONS_ENTITY_READ ORGANIZATIONS_TENANCY_READ ORGANIZATIONS_SUBSCRIPTION_READ ORGANIZATIONS_SUBSCRIPTION_MAPPING_READ ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_READ GOVERNANCE_RULE_READ |
INSPECT + GetLink
|
none |
| USE | READ + ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE
ORGANIZATIONS_DOMAIN_GOVERNANCE_UPDATE ORGANIZATIONS_ENTITY_UPDATE ORGANIZATIONS_SENDER_INVITATION_UPDATE GOVERNANCE_RULE_UPDATE GOVERNANCE_RULE_RETRY |
READ + AcceptRecipientInvitation
GetGovernanceRule
|
none |
| MANAGE | USE + ORGANIZATIONS_LINK_PARENT_DELETE ORGANIZATIONS_LINK_CHILD_DELETE ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATE ORGANIZATIONS_SENDER_INVITATION_CREATE ORGANIZATIONS_DOMAIN_CREATE ORGANIZATIONS_DOMAIN_DELETE ORGANIZATIONS_ORDER_ACTIVATE ORGANIZATIONS_DOMAIN_GOVERNANCE_CREATE ORGANIZATIONS_DOMAIN_GOVERNANCE_DELETE ORGANIZATIONS_ENTITY_UPDATE ORGANIZATIONS_TENANCY_CREATE ORGANIZATIONS_SUBSCRIPTION_MAPPING_DELETE ORGANIZATIONS_TENANCY_DELETE ORGANIZATIONS_TENANCY_RESTORE GOVERNANCE_RULE_CREATE GOVERNANCE_RULE_DELETE |
USE + DeleteLink
|
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_LINK_INSPECT | ListLinks
|
none |
| READ, USE | INSPECT + ORGANIZATIONS_LINK_READ | INSPECT + GetLink |
none |
| MANAGE | USE + ORGANIZATIONS_LINK_PARENT_DELETE ORGANIZATIONS_LINK_CHILD_DELETE |
USE + DeleteLink |
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_RECIPIENT_INVITATION_INSPECT | ListRecipientInvitations
|
none |
| READ | INSPECT + ORGANIZATIONS_RECIPIENT_INVITATION_READ | INSPECT + GetRecipientInvitation |
none |
| USE, MANAGE | READ + ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE | READ + AcceptRecipientInvitation
|
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_SENDER_INVITATION_INSPECT | ListRecipientInvitations
|
none |
| READ | INSPECT + ORGANIZATIONS_SENDER_INVITATION_READ | INSPECT + GetSenderInvitation |
none |
| USE | READ + ORGANIZATIONS_SENDER_INVITATION_UPDATE | READ + UpdateSenderInvitation
|
none |
| MANAGE | USE + ORGANIZATIONS_SENDER_INVITATION_CREATE | USE + CreateSenderInvitation |
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_RECIPIENT_INVITATION_INSPECT ORGANIZATIONS_SENDER_INVITATION_INSPECT |
ListRecipientInvitations
|
none |
| READ | INSPECT + ORGANIZATIONS_RECIPIENT_INVITATION_READ ORGANIZATIONS_SENDER_INVITATION_READ |
INSPECT + GetRecipientInvitation
|
none |
| USE | READ + ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE ORGANIZATIONS_SENDER_INVITATION_UPDATE |
READ + AcceptRecipientInvitation
|
none |
| MANAGE | USE + ORGANIZATIONS_SENDER_INVITATION_CREATE | USE + CreateSenderInvitation |
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_DOMAIN_INSPECT | ListDomains
|
none |
| READ | INSPECT + ORGANIZATIONS_DOMAIN_READ | INSPECT + GetDomain |
none |
| USE | READ + ORGANIZATIONS_DOMAIN_UPDATE | READ + UpdateDomain |
none |
| MANAGE | USE + ORGANIZATIONS_DOMAIN_CREATE ORGANIZATIONS_DOMAIN_DELETE |
USE + CreateDomain
|
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_DOMAIN_GOVERNANCE_INSPECT | ListDomainGovernances
|
none |
| READ | INSPECT + ORGANIZATIONS_DOMAIN_GOVERNANCE_READ | INSPECT + GetDomainGovernance |
none |
| USE | READ + ORGANIZATIONS_DOMAIN_GOVERNANCE_UPDATE | READ + UpdateDomainGovernance |
none |
| MANAGE | USE + ORGANIZATIONS_DOMAIN_GOVERNANCE_CREATE ORGANIZATIONS_DOMAIN_GOVERNANCE_DELETE |
USE + CreateDomainGovernance
|
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_ENTITY_INSPECT | ListOrganizations
|
none |
| READ | INSPECT + ORGANIZATIONS_ENTITY_READ | INSPECT + GetOrganization |
none |
| USE | READ + ORGANIZATIONS_ENTITY_UPDATE | READ + UpdateOrganization |
none |
| MANAGE | - | - | none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_TENANCY_INSPECT | ListOrganizationTenancies
|
none |
| READ, USE | INSPECT + ORGANIZATIONS_TENANCY_READ | INSPECT + GetOrganizationTenancy |
none |
| MANAGE | USE + ORGANIZATIONS_TENANCY_CREATE ORGANIZATIONS_TENANCY_DELETE ORGANIZATIONS_TENANCY_RESTORE |
USE + CreateChildTenancy
|
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | - | - | none |
| READ | - | - | none |
| USE | - | - | none |
| MANAGE | ORGANIZATIONS_ORDER_ACTIVATE | ActivateOrder |
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_SUBSCRIPTION_INSPECT | ListSubscriptions
|
none |
| READ | INSPECT + ORGANIZATIONS_SUBSCRIPTION_READ | INSPECT + GetSubscription |
none |
| USE, MANAGE | USE + ORGANIZATIONS_SUBSCRIPTION_ASSIGN ORGANIZATIONS_SUBSCRIPTION_DELETE |
USE + AssignTenancySubscription
|
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_SUBSCRIPTION_MAPPING_INSPECT | ListSubscriptionMappings
|
none |
| READ | INSPECT + ORGANIZATIONS_SUBSCRIPTION_MAPPING_READ | INSPECT + GetSubscriptionMapping |
none |
| USE, MANAGE | USE + ORGANIZATIONS_SUBSCRIPTION_MAPPING_DELETE ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATE |
USE + DeleteSubscriptionMapping
|
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_INSPECT | ListAssignedSubscriptions
|
none |
| READ | INSPECT + ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_READ | INSPECT + GetAssignedSubscription |
none |
| USE | - | - | none |
| MANAGE | - | - | none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | ORGANIZATIONS_SUBSCRIPTION_REGION_INSPECT | ListAvailableRegions
|
none |
| READ | - | - | none |
| USE | - | - | none |
| MANAGE | - | - | none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | GOVERNANCE_RULE_INSPECT | ListGovernanceRules
|
none |
| READ | INSPECT + GOVERNANCE_RULE_READ | INSPECT + GetGovernanceRule
|
none |
| USE | READ + GOVERNANCE_RULE_UPDATE GOVERNANCE_RULE_RETRY |
READ + GetGovernanceRule
|
none |
| MANAGE | USE + GOVERNANCE_RULE_CREATE GOVERNANCE_RULE_DELETE |
USE + CreateGovernanceRule
|
none |
| Verbs | Permissions | APIs Fully Covered | APIs Partially Covered |
|---|---|---|---|
| INSPECT | GOVERNANCE_RULE_ENFORCED_INSPECT | ListEnforcedGovernanceRules
|
none |
| READ | INSPECT + GOVERNANCE_RULE_ENFORCED_READ | INSPECT + GetEnforcedGovernanceRule |
none |
| USE | - | - | none |
| MANAGE | - | - | none |
Permissions Required for Each API Operation
The following table lists the API operations in a logical order, grouped by resource type. For information about permissions, see Permissions.
| API Operation | Permissions Required to Use the Operation |
|---|---|
| GetLink | ORGANIZATIONS_LINK_READ |
| ListLinks | ORGANIZATIONS_LINK_INSPECT |
| DeleteLink | ORGANIZATIONS_LINK_CHILD_DELETE ORGANIZATIONS_LINK_PARENT_DELETE |
| GetRecipientInvitation | ORGANIZATIONS_RECIPIENT_INVITATION_READ |
| AcceptRecipientInvitation | ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE |
| IgnoreRecipientInvitation | ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE |
| UpdateRecipientInvitation | ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE |
| ListRecipientInvitations | ORGANIZATIONS_RECIPIENT_INVITATION_INSPECT |
| CreateSenderInvitation | ORGANIZATIONS_SENDER_INVITATION_CREATE |
| GetSenderInvitation | ORGANIZATIONS_SENDER_INVITATION_READ |
| ListSenderInvitations | ORGANIZATIONS_SENDER_INVITATION_INSPECT |
| CancelSenderInvitation | ORGANIZATIONS_SENDER_INVITATION_UPDATE |
| UpdateSenderInvitation | ORGANIZATIONS_SENDER_INVITATION_UPDATE |
| UpdateSenderInvitation | ORGANIZATIONS_DOMAIN_READ |
| ListDomains | ORGANIZATIONS_DOMAIN_INSPECT |
| CreateDomain | ORGANIZATIONS_DOMAIN_CREATE |
| UpdateDomain | ORGANIZATIONS_DOMAIN_UPDATE |
| DeleteDomain | ORGANIZATIONS_DOMAIN_DELETE |
| GetDomainGovernance | ORGANIZATIONS_DOMAIN_GOVERNANCE_READ |
| ListDomainGovernances | ORGANIZATIONS_DOMAIN_GOVERNANCE_INSPECT |
| CreateDomainGovernance | ORGANIZATIONS_DOMAIN_GOVERNANCE_CREATE |
| UpdateDomainGovernance | ORGANIZATIONS_DOMAIN_GOVERNANCE_UPDATE |
| DeleteDomainGovernance | ORGANIZATIONS_DOMAIN_GOVERNANCE_DELETE |
| GetOrganization | ORGANIZATIONS_ENTITY_READ |
| ListOrganizations | ORGANIZATIONS_ENTITY_INSPECT |
| UpdateOrganization | ORGANIZATIONS_ENTITY_UPDATE |
| GetOrganizationTenancy | ORGANIZATIONS_TENANCY_READ |
| ListOrganizationTenancies | ORGANIZATIONS_TENANCY_INSPECT |
| approveForTransfer/unapproveForTransfer | ORGANIZATIONS_TENANCY_TRANSFER_APPROVAL_UPDATE |
| CreateChildTenancy | ORGANIZATIONS_TENANCY_CREATE Note: When the subscriptionId attribute is specified for a created child tenancy, then ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATE is also required. For more information see CreateChildTenancyDetails Reference. |
| DeleteOrganizationTenancy | ORGANIZATIONS_TENANCY_DELETE |
| RestoreOrganizationTenancy | ORGANIZATIONS_TENANCY_RESTORE |
| ActivateOrder | ORGANIZATIONS_ORDER_ACTIVATE |
| ListSubscriptions | ORGANIZATIONS_SUBSCRIPTION_INSPECT |
| ListSubscriptionMappings | ORGANIZATIONS_SUBSCRIPTION_MAPPING_INSPECT |
| GetSubscription | ORGANIZATIONS_SUBSCRIPTION_READ |
| GetSubscriptionMapping | ORGANIZATIONS_SUBSCRIPTION_MAPPING_READ |
| AssignTenancySubscription | ORGANIZATIONS_SUBSCRIPTION_ASSIGN |
| AssignDefaultSubscription | ORGANIZATIONS_SUBSCRIPTION_ASSIGN |
| DeleteSubscriptionMapping | ORGANIZATIONS_SUBSCRIPTION_MAPPING_DELETE |
| CreateSubscriptionMapping | ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATE |
| ListAssignedSubscriptions | ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_INSPECT |
| GetAssignedSubscription | ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_READ |
| ListAvailableRegions | ORGANIZATIONS_SUBSCRIPTION_REGION_INSPECT |
| ListGovernanceRules | GOVERNANCE_RULE_INSPECT |
| GetGovernanceRule | GOVERNANCE_RULE_READ |
| CreateGovernanceRule | GOVERNANCE_RULE_CREATE |
| UpdateGovernanceRule | GOVERNANCE_RULE_UPDATE |
| DeleteGovernanceRule | GOVERNANCE_RULE_DELETE |
| RetryGovernanceRule | GOVERNANCE_RULE_RETRY |
| CreateInclusionCriterion | GOVERNANCE_RULE_UPDATE |
| DeleteInclusionCriterion | GOVERNANCE_RULE_UPDATE |
| ListTenancyAttachments | GOVERNANCE_RULE_READ |
| GetTenancyAttachment | GOVERNANCE_RULE_READ |
| RetryTenancyAttachment | GOVERNANCE_RULE_RETRY |
| ListEnforcedGovernanceRules | GOVERNANCE_RULE_ENFORCED_INSPECT |
| GetEnforcedGovernanceRule | GOVERNANCE_RULE_ENFORCED_READ |