Sign in
App Entitlement

Create

Create a new app entitlement for an app. This is used to define a custom permission, group, or role within the app.

post/api/v1/apps/{app_id}/entitlements

Path parameters

app_idstring required

The ID of the app to create the entitlement in.

Request body

aliasstring

A unique alias for the entitlement, used for programmatic lookups and Cone.

annotationsobject

Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars matching URL-safe ASCII; total serialized ≤4096 bytes. Keys starting with c1/ are reserved for server-managed use and rejected on write.

Well-known keys: managed_by, iac_workspace, iac_resource_address, iac_tool_version.

appEntitlementOwnerIdsstring[] nullable

The IDs of users to set as owners of this entitlement.

appResourceIdstring

The ID of the resource that this entitlement belongs to.

appResourceTypeIdstring

The ID of the resource type that this entitlement belongs to.

certifyPolicyIdstring

The ID of the policy to use for certification tasks.

complianceFrameworkValueIdsstring[] nullable

The IDs of compliance frameworks to associate with this entitlement (e.g., SOX, HIPAA).

descriptionstring

The description of the new entitlement.

displayNamestring required

The display name of the new entitlement.

durationGrantstring duration nullable
durationUnsetobject nullable
emergencyGrantEnabledboolean

Whether emergency grant requests are enabled for this entitlement.

emergencyGrantPolicyIdstring

The ID of the policy to use for emergency grant tasks. Required if emergency_grant_enabled is true.

grantPolicyIdstring

The ID of the policy to use for grant request tasks.

matchBatonIdstring

If supplied, it's implied that the entitlement is created before sync and needs to be merged with connector entitlement.

overrideAccessRequestsDefaultsboolean

Whether to override the app-level access request defaults for this entitlement.

purpose'APP_ENTITLEMENT_PURPOSE_VALUE_UNSPECIFIED' | 'APP_ENTITLEMENT_PURPOSE_VALUE_ASSIGNMENT' | 'APP_ENTITLEMENT_PURPOSE_VALUE_PERMISSION' | 'APP_ENTITLEMENT_PURPOSE_VALUE_OWNERSHIP'

The purpose of the entitlement (e.g., assignment, permission, ownership).

revokePolicyIdstring

The ID of the policy to use for revoke request tasks.

riskLevelValueIdstring

The ID of the risk level to assign to this entitlement.

slugstring

A short label describing the permission the entitlement grants (e.g., "Admin", "Read").

Response

Successful response

Changes