> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/access/resources-and-organizations.md).

# Resources and organizations

The 19 shipped resource types with their real hierarchy, search and provisioning flags, and the organization model with its containment rules and seven shipped properties.

## What this is, and when you need it

A **resource** is the protected thing — an application, a menu entry, a URI pattern, a managed system, an OAuth scope, a report. An **organization** is where a person sits in the company, and it is also the scope object for delegated administration. They are on the same page because both are hierarchies with type-driven rules about what may contain what, and both have shipped defaults that surprise people.

The two surprises: four resource types cannot be nested at all, and organization affiliations propagate up the hierarchy automatically because a property ships `true`.

Read this and you will be able to pick the right resource type for a thing you are protecting, predict which parent-child relationships OpenIAM will refuse, tell which resources you are expected to create by hand and which appear on their own, and read a user's affiliation list without being surprised by entries nobody selected. To load a whole organization tree from a file rather than typing it, go to [Import an organization hierarchy from CSV](/administration-guide/access/resources-and-organizations/import-organizations-from-csv.md).

## Resource types

A resource's type is a row in `RESOURCE_TYPE`. Nineteen ship. Three flags matter — `SUPPORTS_HIERARCHY`, `SEARCHABLE` and `PROVISION_RESOURCE` — each held as `Y` or `N`, and each defaulting to `Y` when a row does not state a value. Confirm the list and the flags on your own deployment at **Access Control → Resource Type** (`/webconsole/resourceTypes`), opening a type at `/webconsole/editResourceType`.

| `RESOURCE_TYPE_ID`     | `DESCRIPTION`             | Hierarchy | Searchable | Provision |
| ---------------------- | ------------------------- | --------- | ---------- | --------- |
| `ACTIVITI_REQUEST`     | Activiti Requests         | `Y`       | `Y`        | `N`       |
| `ADMIN_RESOURCE`       | Admin Resource            | **`N`**   | `Y`        | `Y`       |
| `APPLICATION_CATEGORY` | Application category      | `Y`       | `Y`        | `Y`       |
| `AUTH_PROVIDER`        | Authentication Provider   | `Y`       | `Y`        | `Y`       |
| `AUTH_REPO`            | Authentication Repository | `Y`       | `Y`        | `Y`       |
| `CONTENT_PROVIDER`     | Content Provider          | `Y`       | `Y`        | `Y`       |
| `MANAGED_SYS`          | Managed Systems           | `Y`       | `Y`        | `Y`       |
| `MAN_MANAGED_SYS`      | Manual Managed Systems    | `Y`       | `Y`        | `N`       |
| `MENU_ITEM`            | Menus                     | `Y`       | **`N`**    | `Y`       |
| `OAUTH_SCOPE`          | OAuth Scope               | **`N`**   | `Y`        | `Y`       |
| `PROFILE`              | Access Profiles           | `Y`       | `Y`        | `N`       |
| `REPORT`               | Report                    | **`N`**   | `Y`        | `Y`       |
| `SOD_ENTITLEMENT`      | SoD Entitlement           | **`N`**   | `Y`        | `N`       |
| `SYS_ACTION`           | System Action             | `Y`       | `Y`        | `N`       |
| `UI_TEMPLATE`          | UI Template               | `Y`       | `Y`        | `Y`       |
| `UI_WIDGET`            | UI Widget                 | `Y`       | `Y`        | `Y`       |
| `URI_PATTERN_METHOD`   | URI Pattern Method        | `Y`       | `Y`        | `Y`       |
| `URL_PATTERN`          | Url Pattern               | `Y`       | `Y`        | `Y`       |
| `WORKFLOW`             | Protects Workflows        | `Y`       | `Y`        | `Y`       |

The set has accumulated release by release since 2.3.0.0, most recently `SOD_ENTITLEMENT` in 2026.7.1.0, and no release removes a type without immediately putting it back — so the list only grows, and a type present on an older deployment is present on a newer one. If your `/webconsole/resourceTypes` list is longer than nineteen, the extra rows are types somebody added on this deployment.

### What each flag does

**`SUPPORTS_HIERARCHY`** is enforced, and it is the only one of the three that rejects an operation. OpenIAM refuses a parent-child relationship if *either* resource's type has it `N`, and answers with `RESOURCE_TYPE_NOT_SUPPORTS_HIERARCHY`, naming the offending type's description in the message. Four types are affected: `ADMIN_RESOURCE`, `OAUTH_SCOPE`, `REPORT` and `SOD_ENTITLEMENT`. An admin resource in particular is a leaf by design — the delegated-administration scope object is not meant to nest.

**`SEARCHABLE`** filters the resource-type drop-downs and the resource search grid. It decides what is *offered*, not what is *permitted*: a resource of an unsearchable type is still entitleable and still enforced, it simply does not appear in the grid. `MENU_ITEM` is the one type shipped `N`, which is why menu resources do not clutter the resource search even though there are hundreds of them.

**`PROVISION_RESOURCE`** is where the shipped data is misleading. The column held an integer until 4.0.0.0, and the conversion to `Y`/`N` in that release treated both `1` **and** `NULL` as `Y`. Every type that existed before 4.0.0.0 without an explicit value — `AUTH_REPO`, `MENU_ITEM`, `AUTH_PROVIDER`, `CONTENT_PROVIDER`, `URL_PATTERN`, `UI_WIDGET`, `UI_TEMPLATE`, `ADMIN_RESOURCE`, `REPORT`, `URI_PATTERN_METHOD`, `WORKFLOW`, `OAUTH_SCOPE` — therefore reads `Y` today, and reads `Y` on the screen too.

{% hint style="info" %}
`PROVISION_RESOURCE='Y'` on `MENU_ITEM`, `UI_TEMPLATE`, `UI_WIDGET` and `ADMIN_RESOURCE` is an artifact of that `NULL`-to-`Y` conversion, not a statement that menus are provisionable. Do not read intent into it. Nothing in the product branches on this flag; provisioning is driven by the managed system attached to a resource, not by its type's flag. That also means there is no observable check for it — setting it either way changes nothing you can see.
{% endhint %}

## Working with resources

| Route                                               | What it does                                                                      |
| --------------------------------------------------- | --------------------------------------------------------------------------------- |
| `/webconsole/resources`                             | Resource search                                                                   |
| `/webconsole/editResource`                          | Create or edit a resource (`openiam.ui.editresourceurl=/webconsole/editResource`) |
| `/webconsole/resourceEntitlements?id=<RESOURCE_ID>` | The resource's users, groups, roles and organizations                             |
| `/webconsole/resourceTypes`                         | Resource type list                                                                |
| `/webconsole/editResourceType`                      | Create or edit a resource type                                                    |
| `/webconsole/accessRights`                          | Access right list                                                                 |
| `/webconsole/editAccessRight`                       | Create or edit an access right                                                    |

Audit actions: `CREATE_RESOURCE`, `MODIFY_RESOURCE`, `DELETE_RESOURCE`, `CREATE_RESOURCE_TYPE`, `MODIFY_RESOURCE_TYPE`, `DELETE_RESOURCE_TYPE`, `ADD_CHILD_RESOURCE`, `DELETE_CHILD_RESOURCE`, and the entitlement pairs `ADD_ROLE_TO_RESOURCE` / `DELETE_ROLE_FROM_RESOURCE`, `ADD_GROUP_TO_RESOURCE` / `DELETE_GROUP_FROM_RESOURCE`, `ADD_USER_TO_RESOURCE` / `UPDATE_USER_TO_RESOURCE` / `DELETE_USER_FROM_RESOURCE`, `ADD_RESOURCE_TO_ORGANIZATION` / `DELETE_RESOURCE_FROM_ORGANIZATION`.

Most resources are created *for you* rather than by you. Creating a managed system creates its `MANAGED_SYS` resource and a role typed `PROVISION_ROLE`; creating a content provider creates its `CONTENT_PROVIDER` resource; creating a URI pattern creates a `URL_PATTERN` resource plus one `URI_PATTERN_METHOD` resource per HTTP method; activating an SoD rule set creates `SOD_ENTITLEMENT` resources. Create a resource by hand mainly to represent an application or entitlement that has no managed system — a manual application, a physical asset, a licence.

### Adding a resource type

You can add types at `/webconsole/editResourceType`. Set `SUPPORTS_HIERARCHY` deliberately: it is the one flag with enforcement behind it, and changing it later does not unwind relationships already created. Set `SEARCHABLE='Y'` unless you are creating something menu-like that would swamp the search grid.

## The organization model

Organizations live in `COMPANY`, are typed by `ORGANIZATION_TYPE`, and their legal nesting is constrained by `ORG_TYPE_VALID_MEMBERSHIP`.

Four types ship:

| `ORG_TYPE_ID`  | `NAME`       |
| -------------- | ------------ |
| `ORGANIZATION` | Organization |
| `DEPARTMENT`   | Department   |
| `DIVISION`     | Division     |
| `SUBSIDIARY`   | Subsidiary   |

Five valid-containment pairs ship:

| Container      | May contain                            |
| -------------- | -------------------------------------- |
| `ORGANIZATION` | `DEPARTMENT`, `DIVISION`, `SUBSIDIARY` |
| `SUBSIDIARY`   | `DIVISION`                             |
| `DIVISION`     | `DEPARTMENT`                           |

So the deepest shipped chain is `ORGANIZATION → SUBSIDIARY → DIVISION → DEPARTMENT`, and a department may not contain anything. `ORG_TYPE_VALID_MEMBERSHIP` has a unique constraint on `(ORG_TYPE_ID, MEMBER_ORG_TYPE_ID)`, so a pair can only be declared once. Add your own types and containment pairs at **Access Control → Organization Types**: `/webconsole/organizationTypeSearch`, `/webconsole/organizationTypeEdit` and `/webconsole/organizationTypeMembership`. The menu resources that reach those screens are `ORG_TYPE_SUBMENU_ROOT` and `ORG_TYPE_SUBMENU_EDIT`, so if the menu entry is missing, the administrator is not entitled to those two.

| Route                                                               | What it does                       |
| ------------------------------------------------------------------- | ---------------------------------- |
| `/webconsole/organizations`                                         | Organization search                |
| `/webconsole/editOrganization`                                      | Create or edit an organization     |
| `/webconsole/organizationMembership`                                | The organization's members         |
| `/webconsole/organizationLocation`, `/locationNew`, `/locationEdit` | Locations under an organization    |
| `/webconsole/organizationMenuTree`                                  | The organization's navigation tree |

Audit actions `CREATE_ORG`, `MODIFY_ORG`, `DELETE_ORG`, `ADD_USER_TO_ORG`, `DELETE_USER_FROM_ORG`, `IMPORT_ORGANIZATION`, `ADD_APPROVER_TO_ORGANIZATION`, `DELETE_APPROVER_FROM_ORGANIZATION`.

## The seven shipped organization properties

Category **Organization** in the system properties, with the values a freshly migrated database contains:

| Key                                                                     | Shipped value                        | Type                        | Webconsole label                                    |
| ----------------------------------------------------------------------- | ------------------------------------ | --------------------------- | --------------------------------------------------- |
| `org.openiam.organization.type.id`                                      | `ORGANIZATION`                       | `OrganizationType`          | Define the Object That Represents an 'Organization' |
| `org.openiam.division.type.id`                                          | `DIVISION`                           | `OrganizationType`          | Define the Object That Represents a 'Division'      |
| `org.openiam.department.type.id`                                        | `DEPARTMENT`                         | `OrganizationType`          | Define the Object That Represents a 'Department'    |
| `org.openiam.affiliation.primary.type.id`                               | `100`                                | `Organization`              | Primary Affiliation Type                            |
| `org.openiam.selfservice.organization.membership.user.screen.hierarchy` | `ORGANIZATION->DIVISION->DEPARTMENT` | `OrganizationTypeHierarchy` | Organization Hierarchy for UI Templating Engine     |
| `org.openiam.automatic.organization.hierarchy.assignment.enabled`       | `true`                               | `Boolean`                   | Automatic Organization Hierarchy Assignment         |
| `org.openiam.idm.leaver.script`                                         | `batch/LeaverProcess.groovy`         | `Groovy`                    | Termination Script                                  |

The three `*.type.id` keys ship as of 4.0.0.0 and have not changed since. `org.openiam.affiliation.primary.type.id` last changed in 4.1.1.0, and its shipped value `100` is a trap: **it is an organization ID, not an organization-type ID**, despite the key's name. `100` is the seeded `OpenIAM` organization — `COMPANY` row `100`. The user edit screen reads the value and offers it as the primary affiliation type, so putting an `ORG_TYPE_ID` such as `DEPARTMENT` there gives you a primary affiliation that resolves to no organization. Confirm all seven values under **Administration → System Configuration → Organization**; full catalogue in [System properties](/administration-guide/reference/system-properties.md).

### The hierarchy string is a literal, and it has a grammar

`org.openiam.selfservice.organization.membership.user.screen.hierarchy` ships exactly:

{% code overflow="wrap" %}

```
ORGANIZATION->DIVISION->DEPARTMENT
```

{% endcode %}

OpenIAM parses it as: split on `|` into independent *ladders*, then split each ladder on `->` into levels, then resolve each token as an `ORG_TYPE_ID`. Tokens that do not resolve to a real organization type are silently dropped — no error, no log line, just a shorter ladder on screen. The picker itself is the check: if a level you named does not appear in it, that token did not resolve.

So the shipped value defines one three-level ladder. To render two parallel ladders — say the standard one plus a subsidiary-rooted one — the value is:

{% code overflow="wrap" %}

```
ORGANIZATION->DIVISION->DEPARTMENT|ORGANIZATION->SUBSIDIARY->DIVISION->DEPARTMENT
```

{% endcode %}

This property drives the *UI templating engine's* organization pickers. It does not constrain what can actually be saved — that is `ORG_TYPE_VALID_MEMBERSHIP`. Keeping the two consistent is your job; a ladder that names a containment the membership table forbids will render a picker whose selection cannot be saved.

### Automatic hierarchy assignment: the shipped default is `true`

`org.openiam.automatic.organization.hierarchy.assignment.enabled` ships `true`. While it is `true`, every save that *adds* an affiliation also finds each added organization's parents, adds affiliations to those, and keeps going until it reaches the roots.

So affiliating a user to a department in the shipped hierarchy affiliates them to the division and the organization as well, in one save. The removal side is symmetric: deleting one affiliation removes the child and parent organization affiliations of the one you deleted along with it.

The check is the user's own record. Affiliate a test user to a leaf organization, save, and reopen the user's **Organizations** tab — the ancestors you did not select are the ones the property added.

{% hint style="warning" %}
This means a user's affiliation list will not match what an administrator selected, and removing one affiliation can remove several. It is usually what you want — organization scope should be transitive — but it interacts badly with two things: business-rule conditions on `AFFILIATIONS`, which will match on ancestors the administrator never chose, and delegated administration scoped by organization, which will be broader than the selection implies. Set the property to `false` if you need affiliations to mean exactly what was selected, and re-test both cases.
{% endhint %}

## Organizations as delegated scope

An organization is also an administrative boundary. Two mechanisms use it:

* **`ADMIN_RESOURCE` resources** — the delegated-administration scope object, and the one resource type deliberately non-hierarchical. See [Scope a delegated administrator](/administration-guide/identities/delegated-administration.md).
* **The role's Virtual tenant role field** — `SUPER_SEC_ADMIN` sees everything, while `ORGANIZATION_ADMIN` and `END_USER` can only retrieve entitlements whose organization matches the requester's. Set it on the role form. See [Role and group field reference](/administration-guide/access/manage-roles-and-groups/role-and-group-reference.md#virtual-tenant-role-is-a-visibility-filter-not-a-job-title).

Both are tenant-scope changes: they alter what every administrator can see. Treat them as reviewed changes, not tweaks.

## Verification

| What to check                                        | Where                                                                                                                                                                                                        |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| A resource type's flags                              | Reopen `/webconsole/editResourceType`; or read `RESOURCE_TYPE` directly                                                                                                                                      |
| A resource hierarchy saved                           | Reopen the parent; a rejection returns `RESOURCE_TYPE_NOT_SUPPORTS_HIERARCHY` naming the offending type                                                                                                      |
| An organization's legal children                     | `ORG_TYPE_VALID_MEMBERSHIP` for the pair; the picker offers only valid types                                                                                                                                 |
| Automatic hierarchy assignment fired                 | The user's affiliation list contains ancestors you did not select                                                                                                                                            |
| The change was recorded                              | `CREATE_RESOURCE` / `MODIFY_RESOURCE`, `CREATE_ORG` / `MODIFY_ORG`, `ADD_USER_TO_ORG`                                                                                                                        |
| Effective access reflects a new resource entitlement | The user's effective access. If the membership is right and the access is wrong, the graph is stale — [Rebuild the authorization graph](/administration-guide/operations/rebuild-the-authorization-graph.md) |

## When it goes wrong

| Symptom                                                              | Cause                                                                                                                                  | Fix                                                                                                         |
| -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Cannot nest one resource under another                               | Either type has `SUPPORTS_HIERARCHY='N'` — `ADMIN_RESOURCE`, `OAUTH_SCOPE`, `REPORT`, `SOD_ENTITLEMENT`                                | Model the relationship through a role instead; the error names the type's description                       |
| A resource type is missing from a drop-down                          | `SEARCHABLE='N'` on that type — shipped only for `MENU_ITEM`                                                                           | Set `SEARCHABLE='Y'` at `/webconsole/editResourceType`, understanding it will now appear in resource search |
| A user has affiliations nobody assigned                              | `org.openiam.automatic.organization.hierarchy.assignment.enabled` is `true` and ancestors were added                                   | Expected; set the property `false` if you need literal affiliations                                         |
| Removing one affiliation removed several                             | Automatic hierarchy assignment is symmetric — removing an affiliation removes the child and parent affiliations of the one you deleted | Same property; re-add explicitly after changing it                                                          |
| The organization picker offers a level that will not save            | The hierarchy property names a containment `ORG_TYPE_VALID_MEMBERSHIP` does not allow                                                  | Reconcile the two: fix the ladder or add the containment pair                                               |
| An organization type in the hierarchy property is ignored            | OpenIAM silently drops hierarchy tokens that are not real `ORG_TYPE_ID` values                                                         | Check spelling against `ORGANIZATION_TYPE` — the four shipped IDs are upper-case                            |
| A resource appeared that nobody created                              | A managed system, content provider, URI pattern or SoD rule set created it                                                             | Expected; find the owning object rather than deleting the resource                                          |
| Business rule matched on an organization the user was never assigned | Automatic hierarchy assignment added the ancestor, and the rule tests `AFFILIATIONS`                                                   | Condition on the specific child organization, or disable automatic assignment                               |

## Now do something with it

| Once you have decided…                                                  | Go to                                                                                                                                  |
| ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| …that you need the whole organization tree loaded from a file           | [Import an organization hierarchy from CSV](/administration-guide/access/resources-and-organizations/import-organizations-from-csv.md) |
| …that the resource is a URI pattern behind the gateway                  | [Content providers and URI patterns](/administration-guide/access/content-providers-and-uri-patterns.md)                               |
| …that an administrator's scope should be an organization                | [Scope a delegated administrator](/administration-guide/identities/delegated-administration.md)                                        |
| …that a role, not a resource hierarchy, should express the relationship | [Create a role](/administration-guide/access/create-a-role.md)                                                                         |

## Related

* [The access model](/administration-guide/access/access-model.md) — resources, access rights and the entitlement model
* [Content providers and URI patterns](/administration-guide/access/content-providers-and-uri-patterns.md) — the `CONTENT_PROVIDER`, `URL_PATTERN` and `URI_PATTERN_METHOD` resources
* [Scope a delegated administrator](/administration-guide/identities/delegated-administration.md) — `ADMIN_RESOURCE` in practice
* [System properties](/administration-guide/reference/system-properties.md) — all 704 keys with shipped defaults
* [Import roles, groups, organizations and entitlement memberships](/administration-guide/lifecycle/synchronize-and-import-data/import-roles-groups-and-memberships.md) — the fixed order the entitlement and membership imports have to run in
* [Promote configuration between environments](/administration-guide/platform/import-export-and-promotion.md) — promoting organizations between environments with the `import-export` utility

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/access/resources-and-organizations.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.