Apply automatic changes

dereferenced/deref-sailpoint-api.beta.json

@@ -7033,7 +7033,7 @@
         "tags": [
           "Access Requests"
         ],
-        "description": "This submits the access request into IdentityNow, where it will follow any IdentityNow approval processes.\n\nAccess requests are processed asynchronously by IdentityNow.  A success response from this endpoint means the request\nhas been submitted to IDN and is queued for processing.  Because this endpoint is asynchronous, it will not return an error\nif you submit duplicate access requests in quick succession, or you submit an access request for access that is already in progress, approved, or rejected.\nIt is best practice to check for any existing access requests that reference the same access items before submitting a new access request.  This can\nbe accomplished by using the [access request status](https://developer.sailpoint.com/idn/api/v3/list-access-request-status) or the [pending access request approvals](https://developer.sailpoint.com/idn/api/v3/list-pending-approvals) endpoints.  You can also\nuse the [search API](https://developer.sailpoint.com/idn/api/v3/search) to check the existing access items that an identity has before submitting\nan access request to ensure you are not requesting access that is already granted.\n\nThere are two types of access request:\n\n__GRANT_ACCESS__\n* Can be requested for multiple identities in a single request.\n* Supports self request and request on behalf of other users. Refer to the [Get Access Request Configuration](https://developer.sailpoint.com/idn/api/v3/get-access-request-config) endpoint for request configuration options.  \n* Allows any authenticated token (except API) to call this endpoint to request to grant access to themselves. Depending on the configuration, a user can request access for others.\n* Roles, access profiles and entitlements can be requested.\n* While requesting entitlements, maximum of 25 entitlements and 10 recipients are allowed in a request.\n \n__REVOKE_ACCESS__\n* Can only be requested for a single identity at a time.\n* Does not support self request. Only manager can request to revoke access for their directly managed employees.\n* If a `removeDate` is specified, then the access will be removed on that date and time only for roles and access profiles. Entitlements are currently unsupported for `removeDate`.\n* Roles, access profiles, and entitlements can be requested for revocation.\n* Revoke requests for entitlements are limited to 1 entitlement per access request currently.\n* [Roles, Access Profiles] You can specify a `removeDate` if the access doesn't already have a sunset date. The `removeDate` must be a future date, in the UTC timezone. \n* Allows a manager to request to revoke access for direct employees. A token with ORG_ADMIN authority can also request to revoke access from anyone.\n\n>**Note:** There is no indication to the approver in the IdentityNow UI that the approval request is for a revoke action. Take this into consideration when calling this API.\n\nA token with API authority cannot be used to call this endpoint. \n",
+        "description": "This submits the access request into IdentityNow, where it will follow any IdentityNow approval processes.\n\nAccess requests are processed asynchronously by IdentityNow.  A success response from this endpoint means the request\nhas been submitted to IDN and is queued for processing.  Because this endpoint is asynchronous, it will not return an error\nif you submit duplicate access requests in quick succession, or you submit an access request for access that is already in progress, approved, or rejected.\nIt is best practice to check for any existing access requests that reference the same access items before submitting a new access request.  This can\nbe accomplished by using the [access request status](https://developer.sailpoint.com/idn/api/v3/list-access-request-status) or the [pending access request approvals](https://developer.sailpoint.com/idn/api/v3/list-pending-approvals) endpoints.  You can also\nuse the [search API](https://developer.sailpoint.com/idn/api/v3/search) to check the existing access items that an identity has before submitting\nan access request to ensure you are not requesting access that is already granted.\n\nThere are two types of access request:\n\n__GRANT_ACCESS__\n* Can be requested for multiple identities in a single request.\n* Supports self request and request on behalf of other users. Refer to the [Get Access Request Configuration](https://developer.sailpoint.com/idn/api/v3/get-access-request-config) endpoint for request configuration options.  \n* Allows any authenticated token (except API) to call this endpoint to request to grant access to themselves. Depending on the configuration, a user can request access for others.\n* Roles, access profiles and entitlements can be requested.\n* While requesting entitlements, maximum of 25 entitlements and 10 recipients are allowed in a request.\n \n__REVOKE_ACCESS__\n* Can only be requested for a single identity at a time.\n* You cannot use an access request to revoke access from an identity if that access has been granted by role membership or by birthright provisioning. \n* Does not support self request. Only manager can request to revoke access for their directly managed employees.\n* If a `removeDate` is specified, then the access will be removed on that date and time only for roles and access profiles. Entitlements are currently unsupported for `removeDate`.\n* Roles, access profiles, and entitlements can be requested for revocation.\n* Revoke requests for entitlements are limited to 1 entitlement per access request currently.\n* [Roles, Access Profiles] You can specify a `removeDate` if the access doesn't already have a sunset date. The `removeDate` must be a future date, in the UTC timezone. \n* Allows a manager to request to revoke access for direct employees. A token with ORG_ADMIN authority can also request to revoke access from anyone.\n\n>**Note:** There is no indication to the approver in the IdentityNow UI that the approval request is for a revoke action. Take this into consideration when calling this API.\n\nA token with API authority cannot be used to call this endpoint. \n",
         "requestBody": {
           "required": true,
           "content": {

dereferenced/deref-sailpoint-api.beta.yaml

@@ -6134,6 +6134,7 @@ paths:
 
         __REVOKE_ACCESS__
         * Can only be requested for a single identity at a time.
+        * You cannot use an access request to revoke access from an identity if that access has been granted by role membership or by birthright provisioning. 
         * Does not support self request. Only manager can request to revoke access for their directly managed employees.
         * If a `removeDate` is specified, then the access will be removed on that date and time only for roles and access profiles. Entitlements are currently unsupported for `removeDate`.
         * Roles, access profiles, and entitlements can be requested for revocation.

dereferenced/deref-sailpoint-api.v3.json

@@ -5013,7 +5013,7 @@
         "tags": [
           "Access Requests"
         ],
-        "description": "This submits the access request into IdentityNow, where it will follow any IdentityNow approval processes.\n\nAccess requests are processed asynchronously by IdentityNow.  A success response from this endpoint means the request\nhas been submitted to IDN and is queued for processing.  Because this endpoint is asynchronous, it will not return an error\nif you submit duplicate access requests in quick succession, or you submit an access request for access that is already in progress, approved, or rejected.\nIt is best practice to check for any existing access requests that reference the same access items before submitting a new access request.  This can\nbe accomplished by using the [access request status](https://developer.sailpoint.com/idn/api/v3/list-access-request-status) or the [pending access request approvals](https://developer.sailpoint.com/idn/api/v3/list-pending-approvals) endpoints.  You can also\nuse the [search API](https://developer.sailpoint.com/idn/api/v3/search) to check the existing access items that an identity has before submitting\nan access request to ensure you are not requesting access that is already granted.\n\nThere are two types of access request:\n\n__GRANT_ACCESS__\n* Can be requested for multiple identities in a single request.\n* Supports self request and request on behalf of other users. Refer to the [Get Access Request Configuration](https://developer.sailpoint.com/idn/api/v3/get-access-request-config) endpoint for request configuration options.  \n* Allows any authenticated token (except API) to call this endpoint to request to grant access to themselves. Depending on the configuration, a user can request access for others.\n* Roles, access profiles and entitlements can be requested.\n* While requesting entitlements, maximum of 25 entitlements and 10 recipients are allowed in a request.\n \n__REVOKE_ACCESS__\n* Can only be requested for a single identity at a time.\n* Does not support self request. Only manager can request to revoke access for their directly managed employees.\n* If a `removeDate` is specified, then the access will be removed on that date and time only for roles and access profiles. Entitlements are currently unsupported for `removeDate`.\n* Roles, access profiles, and entitlements can be requested for revocation.\n* Revoke requests for entitlements are limited to 1 entitlement per access request currently.\n* [Roles, Access Profiles] You can specify a `removeDate` if the access doesn't already have a sunset date. The `removeDate` must be a future date, in the UTC timezone. \n* Allows a manager to request to revoke access for direct employees. A token with ORG_ADMIN authority can also request to revoke access from anyone.\n\n>**Note:** There is no indication to the approver in the IdentityNow UI that the approval request is for a revoke action. Take this into consideration when calling this API.\n\nA token with API authority cannot be used to call this endpoint. \n",
+        "description": "This submits the access request into IdentityNow, where it will follow any IdentityNow approval processes.\n\nAccess requests are processed asynchronously by IdentityNow.  A success response from this endpoint means the request\nhas been submitted to IDN and is queued for processing.  Because this endpoint is asynchronous, it will not return an error\nif you submit duplicate access requests in quick succession, or you submit an access request for access that is already in progress, approved, or rejected.\nIt is best practice to check for any existing access requests that reference the same access items before submitting a new access request.  This can\nbe accomplished by using the [access request status](https://developer.sailpoint.com/idn/api/v3/list-access-request-status) or the [pending access request approvals](https://developer.sailpoint.com/idn/api/v3/list-pending-approvals) endpoints.  You can also\nuse the [search API](https://developer.sailpoint.com/idn/api/v3/search) to check the existing access items that an identity has before submitting\nan access request to ensure you are not requesting access that is already granted.\n\nThere are two types of access request:\n\n__GRANT_ACCESS__\n* Can be requested for multiple identities in a single request.\n* Supports self request and request on behalf of other users. Refer to the [Get Access Request Configuration](https://developer.sailpoint.com/idn/api/v3/get-access-request-config) endpoint for request configuration options.  \n* Allows any authenticated token (except API) to call this endpoint to request to grant access to themselves. Depending on the configuration, a user can request access for others.\n* Roles, access profiles and entitlements can be requested.\n* While requesting entitlements, maximum of 25 entitlements and 10 recipients are allowed in a request.\n \n__REVOKE_ACCESS__\n* Can only be requested for a single identity at a time.\n* You cannot use an access request to revoke access from an identity if that access has been granted by role membership or by birthright provisioning. \n* Does not support self request. Only manager can request to revoke access for their directly managed employees.\n* If a `removeDate` is specified, then the access will be removed on that date and time only for roles and access profiles. Entitlements are currently unsupported for `removeDate`.\n* Roles, access profiles, and entitlements can be requested for revocation.\n* Revoke requests for entitlements are limited to 1 entitlement per access request currently.\n* [Roles, Access Profiles] You can specify a `removeDate` if the access doesn't already have a sunset date. The `removeDate` must be a future date, in the UTC timezone. \n* Allows a manager to request to revoke access for direct employees. A token with ORG_ADMIN authority can also request to revoke access from anyone.\n\n>**Note:** There is no indication to the approver in the IdentityNow UI that the approval request is for a revoke action. Take this into consideration when calling this API.\n\nA token with API authority cannot be used to call this endpoint. \n",
         "requestBody": {
           "required": true,
           "content": {

dereferenced/deref-sailpoint-api.v3.yaml

@@ -4553,6 +4553,7 @@ paths:
 
         __REVOKE_ACCESS__
         * Can only be requested for a single identity at a time.
+        * You cannot use an access request to revoke access from an identity if that access has been granted by role membership or by birthright provisioning. 
         * Does not support self request. Only manager can request to revoke access for their directly managed employees.
         * If a `removeDate` is specified, then the access will be removed on that date and time only for roles and access profiles. Entitlements are currently unsupported for `removeDate`.
         * Roles, access profiles, and entitlements can be requested for revocation.