Public/Access/New-SIAAccessRequest.ps1
|
function New-SIAAccessRequest { <# .SYNOPSIS Creates a SIA access request. .DESCRIPTION Submits a just-in-time access request for a specified target category. Call Get-SIAAccessRequestForm first to discover the exact -RequestDetails fields your tenant's workflow expects for the target category you're requesting, since that part of the schema is defined per target category rather than fixed. CyberArk's currently published schema documents only one value for -TargetCategory: 'CLOUD_CONSOLE' (AWS/Azure/GCP console access via Secure Cloud Access). No SIA-specific infrastructure target category (VM, database, and so on) appears in the published enum at the time of writing - see docs/LIMITATIONS.md. If your tenant's SIA workflow uses a different category value, pass it anyway; -TargetCategory accepts any string, it just documents the one value CyberArk currently publishes. .PARAMETER TargetCategory The type of target access is being requested for. .PARAMETER RequestType The access request workflow type: 'ON_DEMAND' (default) or 'DUAL_CONTROL'. .PARAMETER RequestDetails The request details, shaped per Get-SIAAccessRequestForm for the selected target category. .EXAMPLE New-SIAAccessRequest -TargetCategory CLOUD_CONSOLE -RequestDetails @{ locationType = 'Azure' roleId = '/providers/Microsoft.Authorization/roleDefinitions/...' workspaceId = 'subscriptions/.../resourceGroups/...' orgId = '...' } Submits a new access request for Azure console access. .INPUTS None. .OUTPUTS psSIA.AccessRequest .LINK https://api-docs.cyberark.com/access-request-api/docs/access-request-api #> [CmdletBinding(SupportsShouldProcess)] [OutputType('psSIA.AccessRequest')] param( [Parameter(Mandatory)] [string]$TargetCategory, [ValidateSet('ON_DEMAND', 'DUAL_CONTROL')] [string]$RequestType = 'ON_DEMAND', [Parameter(Mandatory)] [hashtable]$RequestDetails ) if ($PSCmdlet.ShouldProcess('SIA', 'Create access request')) { $body = @{ targetCategory = $TargetCategory requestType = $RequestType requestDetails = $RequestDetails } Invoke-SIARequest -Method POST -Path '/workflows/requests' -Body $body -Service Uar | ConvertFrom-SIAResponse -TypeName 'psSIA.AccessRequest' } } |