accessPackageAssignmentRequest: resume

Namespace: microsoft.graph

Resume a user's access package request after waiting for a callback from a custom extension.

In Microsoft Entra entitlement management, when an access package policy has been enabled to call out a custom extension and the request processing is waiting for the callback from the customer, the customer can initiate a resume action. It's performed on an accessPackageAssignmentRequest object whose requestStatus is in a WaitingForCallback state.

This API is available in the following national cloud deployments.

Global service US Government L4 US Government L5 (DOD) China operated by 21Vianet

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type Least privileged permissions Higher privileged permissions
Delegated (work or school account) EntitlementManagement.ReadWrite.All Not available.
Delegated (personal Microsoft account) Not supported. Not supported.
Application EntitlementManagement.ReadWrite.All Not available.

Important

App-only access can be authorized without granting the EntitlementManagement.ReadWrite.All application permission to the caller. Instead, assign the caller an Entitlement Management role, where Access package assignment manager is the least privileged role supported for this operation. For more information on how to assign an Entitlement Management role, see Create unifiedRoleAssignment or Delegate access governance to access package managers in entitlement management.

HTTP request

POST /identityGovernance/entitlementManagement/assignmentRequests/{accessPackageAssignmentRequestId}/resume

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
Content-Type application/json. Required.

Request body

In the request body, supply a JSON representation of the parameters.

The following table shows the parameters that can be used with this action.

Parameter Type Description
source String Source from where customer is trying to resume the request, which can be stored in service and will be helpful for auditing.
type String Indicate at which stage the custom callout extension was executed. The possible values are: microsoft.graph.accessPackageCustomExtensionStage.assignmentRequestCreated, microsoft.graph.accessPackageCustomExtensionStage.assignmentRequestApproved, microsoft.graph.accessPackageCustomExtensionStage.assignmentRequestGranted, microsoft.graph.accessPackageCustomExtensionStage.assignmentRequestRemoved
data accessPackageAssignmentRequestCallbackData Contains information about the instance of the callout that was made to the customer endpoint.

Response

If successful, this action returns a 204 No Content response code.

Examples

Example 1: Resume an access package assignment request

Request

The following example shows a request of a call to resume an access package assignment request that's waiting for a callback.

POST https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests/0e60f18c-b2a0-4887-9da8-da2e30a39d99/resume
Content-Type: application/json

{
  "source": "Contoso.SodCheckProcess",
  "type": "microsoft.graph.accessPackageCustomExtensionStage.assignmentRequestCreated",
  "data": {
    "@odata.type": "microsoft.graph.accessPackageAssignmentRequestCallbackData",
    "stage": "assignmentRequestCreated",
    "customExtensionStageInstanceId": "957d0c50-466b-4840-bb5b-c92cea7141ff",
    "customExtensionStageInstanceDetail": "This user is all verified"
  }
}

Response

The following example shows the response.

HTTP/1.1 204 No Content

Example 2: Resume and deny an access package assignment request

Request

The following example shows a request to resume the processing of an access package assignment request by denying the request that's waiting for a callback. A request cannot be denied at the assignmentRequestCreated stage of the callout.

POST https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentRequests/9e60f18c-b2a0-4887-9da8-da2e30a39d99/resume
Content-Type: application/json

{
  "source": "Contoso.SodCheckProcess",
  "type": "microsoft.graph.accessPackageCustomExtensionStage.assignmentRequestCreated",
  "data": {
    "@odata.type": "microsoft.graph.accessPackageAssignmentRequestCallbackData",
    "stage": "AssignmentRequestCreated",
    "customExtensionStageInstanceId": "857d0c50-466b-4840-bb5b-c92cea7141ff",
    "state": "denied",
    "customExtensionStageInstanceDetail": "Potential risk user based on the SOD check"
  }
}

Response

The following example shows the response.

HTTP/1.1 204 No Content