> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/reference/enums.md).

# Enumerated value reference

Every enumerated value an OpenIAM administrator can choose, and the field or drop-down that offers each set.

## What this is, and when you need it

Most OpenIAM configuration screens present drop-downs. This page lists what is in them, what gets stored when you pick one, and which field or drop-down each set belongs to.

These are the values the product actually accepts. Where a screen shows a friendly label, the constant beside it here is what gets persisted, what appears in an export, and what you must use in a Groovy script, an import file or a SQL query. The **What it carries** column, where a set has one, shows the strings the constant is built from — usually its stored value first and its screen label second, so you can match a label you can see to a value you have to type.

{% hint style="info" %}
Each section names how many values the set holds and where the set is offered. Compare that count against your own drop-down: if yours is shorter, the set was extended in a release later than the one you run. No screen in OpenIAM prints a complete enumerated set, so an inventory this exhaustive cannot be confirmed from the console — where a value's absence would change a decision, confirm it with support rather than inferring it from an empty drop-down.
{% endhint %}

## Reconciliation situations

The four states a compared object can be in. A reconciliation configuration assigns one response to each.

**Where you meet them.** As the four fixed rows of the situation-to-response matrix on a reconciliation configuration: you choose one response per situation, and there is no way to add a situation. All 4:

`IDM_DELETED__SYS_EXISTS` `IDM_EXISTS__SYS_EXISTS` `IDM_EXISTS__SYS_NOT_EXISTS` `SYS_EXISTS__IDM_NOT_EXISTS`

## Reconciliation responses

What OpenIAM does about a situation. Not every response is valid for every object type — group reconciliation supports a smaller set.

**Where you meet them.** In the response drop-down beside each situation on a reconciliation configuration, and as the value a reconciliation script returns to decide an object's fate. All 11:

| Value                 | What it carries                                              |
| --------------------- | ------------------------------------------------------------ |
| `NOTHING`             | `"NOTHING", "DO NOTHING"`                                    |
| `NOTHING_AND_INFORM`  | `"NOTHING_AND_INFORM", "DO NOTHING AND INFORM"`              |
| `ADD_TO_IDM`          | `"ADD_TO_IDM", "Add Record to IDM from Resource"`            |
| `DELETE_FROM_RES`     | `"DELETE_FROM_RES", "Delete from Resource"`                  |
| `DISABLE_IN_RES`      | `"DISABLE_IN_RES", "Disable (or change status in Resource)"` |
| `DELETE_FROM_IDM`     | `"DELETE_FROM_IDM", "Delete from IDM"`                       |
| `REMOVE_FROM_IDM`     | `"REMOVE_FROM_IDM", "Remove from IDM"`                       |
| `DISABLE_IN_IDM`      | `"DISABLE_IN_IDM", "Disable (or change status in IDM)"`      |
| `ADD_TO_RES`          | `"ADD_TO_RES", "Add Record to Resource from IDM"`            |
| `UPDATE_IDM_FROM_RES` | `"UPDATE_IDM_FROM_RES", "Update IDM from Resource"`          |
| `UPDATE_RES_FROM_IDM` | `"UPDATE_RES_FROM_IDM", "Update Resource from IDM"`          |

## User statuses

Every value the user status field can hold.

**Where you meet them.** In the **Status** field on a user record and in a user search filter, and as the value carried in audit records and provisioning requests for that user. All 21:

| Value                     | What it carries             |
| ------------------------- | --------------------------- |
| `ACTIVE`                  | `"ACTIVE"`                  |
| `INACTIVE`                | `"INACTIVE"`                |
| `PENDING_START_DATE`      | `"PENDING_START_DATE"`      |
| `PENDING_APPROVAL`        | `"PENDING_APPROVAL"`        |
| `APPROVAL_DECLINED`       | `"APPROVAL_DECLINED"`       |
| `PENDING_USER_VALIDATION` | `"PENDING_USER_VALIDATION"` |
| `PENDING_INITIAL_LOGIN`   | `"PENDING_INITIAL_LOGIN"`   |
| `TERMINATED`              | `"TERMINATED"`              |
| `DEACTIVATED`             | `"DEACTIVATED"`             |
| `REMOVE`                  | `"REMOVE"`                  |
| `LOCKED`                  | `"LOCKED"`                  |
| `LOCKED_ADMIN`            | `"LOCKED_ADMIN"`            |
| `DISABLED`                | `"DISABLED"`                |
| `RETIRED`                 | `"RETIRED"`                 |
| `LEAVE`                   | `"LEAVE"`                   |
| `PENDING_DELETE`          | `"PENDING_DELETE"`          |
| `PENDING_DEACTIVATION`    | `"PENDING_DEACTIVATION"`    |
| `DECEASED`                | `"DECEASED"`                |
| `LEAVE_WITH_PAY`          | `"LEAVE_WITH_PAY"`          |
| `LEAVE_OF_ABSENCE`        | `"LEAVE_OF_ABSENCE"`        |
| `PENDING_DISABILITY`      | `"PENDING_DISABILITY"`      |

## Bulk operations

Operations offered by the bulk user administration screen.

**Where you meet them.** In the operation drop-down on the bulk user administration screen. Your deployment may offer fewer than are listed here, because an operation your licence or configuration does not cover is not shown. All 25:

| Value                          | What it carries                                                  |
| ------------------------------ | ---------------------------------------------------------------- |
| `ACTIVATE_USER`                | `"ACTIVATE_USER", "Activate"`                                    |
| `DEACTIVATE_USER`              | `"DEACTIVATE_USER", "DeActivate"`                                |
| `DELETE_USER`                  | `"DELETE_USER", "Delete"`                                        |
| `ENABLE_USER`                  | `"ENABLE_USER", "Enable"`                                        |
| `DISABLE_USER`                 | `"DISABLE_USER", "Disable"`                                      |
| `RESET_USER_PASSWORD`          | `"RESET_USER_PASSWORD", "Reset Password"`                        |
| `NOTIFY_USER`                  | `"NOTIFY_USER", "Send Email Notification"`                       |
| `ADD_ENTITLEMENT`              | `"ADD_ENTITLEMENT", "Add"`                                       |
| `DELETE_ENTITLEMENT`           | `"DELETE_ENTITLEMENT", "Delete"`                                 |
| `CHANGE_LAST_DATE`             | `"CHANGE_LAST_DATE", "Change LastDate"`                          |
| `CHANGE_SUPERVISOR`            | `"CHANGE_SUPERVISOR", "Change Supervisor"`                       |
| `CHANGE_MANAGED_SYSTEM`        | `"CHANGE_MANAGED_SYSTEM", "Change managed system"`               |
| `CHANGE_CLASSIFICATION`        | `"CHANGE_CLASSIFICATION", "Change classification"`               |
| `CHANGE_MAX_USERS`             | `"CHANGE_MAX_USERS", "Change max users count"`                   |
| `CHANGE_MEMBERSHIP_DURATION`   | `"CHANGE_MEMBERSHIP_DURATION", "Change membership duration"`     |
| `CHANGE_OWNER`                 | `"CHANGE_OWNER", "Change owner"`                                 |
| `CHANGE_ADMIN`                 | `"CHANGE_ADMIN", "Change admin"`                                 |
| `CHANGE_PASSWORD_POLICY`       | `"CHANGE_PASSWORD_POLICY", "Change password policy"`             |
| `CHANGE_RISK`                  | `"CHANGE_RISK", "Change risk"`                                   |
| `CHANGE_STATUS`                | `"CHANGE_STATUS", "Change status"`                               |
| `CHANGE_VISIBLE`               | `"CHANGE_VISIBLE", "Change visible"`                             |
| `CHANGE_ASSIGN_TO_ALL`         | `"CHANGE_ASSIGN_TO_ALL", "Change assign to all"`                 |
| `CHANGE_DESCRIPTION`           | `"CHANGE_DESCRIPTION", "Change description"`                     |
| `DELETE_ENTITLEMENT_ATTRIBUTE` | `"DELETE_ENTITLEMENT_ATTRIBUTE", "Delete entitlement attribute"` |
| `ADD_ENTITLEMENT_ATTRIBUTE`    | `"ADD_ENTITLEMENT_ATTRIBUTE", "Add entitlement attribute"`       |

## Adaptive authentication risk types

The signals an adaptive authentication rule can evaluate.

**Where you meet them.** In the signal drop-down when you add a condition to an adaptive authentication rule. All 14:

| Value                          | What it carries                          |
| ------------------------------ | ---------------------------------------- |
| `CUSTOM_ADAPTIVE_RISK`         | `"CUSTOM_ADAPTIVE_RISK", false, true`    |
| `IS_NEW_IP`                    | `"IS_NEW_IP", false, false`              |
| `IS_NEW_CITY`                  | `"IS_NEW_CITY", true, true`              |
| `MEMBER_OF_COUNTRY`            | `"MEMBER_OF_COUNTRY", true, false`       |
| `IS_NEW_COUNTRY`               | `"IS_NEW_COUNTRY", true, true`           |
| `KNOWN_DEVICE`                 | `"KNOWN_DEVICE", false, false`           |
| `USER_AGENT`                   | `"USER_AGENT", false, false`             |
| `MEMBER_OF_ROLES`              | `"MEMBER_OF_ROLES", false, false`        |
| `MEMBER_OF_GROUPS`             | `"MEMBER_OF_GROUPS", false, false`       |
| `IS_NEW_DEVICE`                | `"IS_NEW_DEVICE", false, true`           |
| `FORGOT_PHONE`                 | `"FORGOT_PHONE", false, false`           |
| `IS_RISKY_BEHAVIOURAL_PATTERN` | `"FORGOT_PHONE", false, false`           |
| `USER_VERIFIED`                | `"USER_VERIFIED", false, false`          |
| `HAS_APPROVED_AUTH_TYPE`       | `"HAS_APPROVED_AUTH_TYPE", false, false` |

## OAuth 2.0 constants and grant flows

Wire parameter names and the provider grant-flow values.

**Where you meet them.** The grant-flow values appear as choices on an OAuth client; the rest are wire parameter names, which you see in a browser query string, an authorization request, or a gateway log rather than on any screen. All 24:

| Value                     | What it carries             |
| ------------------------- | --------------------------- |
| `CLIENT_ID`               | `"client_id"`               |
| `CLIENT_SECRET`           | `"client_secret"`           |
| `CLIENT_ASSERTION`        | `"client_assertion"`        |
| `CLIENT_ASSERTION_TYPE`   | `"client_assertion_type"`   |
| `GRANT_TYPE`              | `"grant_type"`              |
| `REDIRECT_URI`            | `"redirect_uri"`            |
| `CODE`                    | `"code"`                    |
| `REFRESH_TOKEN`           | `"refresh_token"`           |
| `CODE_VERIFIER`           | `"code_verifier"`           |
| `USERNAME`                | `"username"`                |
| `PASSWORD`                | `"password"`                |
| `DEVICE_CODE`             | `"device_code"`             |
| `STATE`                   | `"state"`                   |
| `PROMPT`                  | `"prompt"`                  |
| `ERROR`                   | `"error"`                   |
| `ERROR_DESCRIPTION`       | `"error_description"`       |
| `IMPLICIT`                | `"IMPLICIT"`                |
| `AUTHORIZATION_CODE`      | `"AUTHORIZATION_CODE"`      |
| `AUTHORIZATION_CODE_PKCE` | `"AUTHORIZATION_CODE_PKCE"` |
| `RESOURCE_OWNER`          | `"RESOURCE_OWNER"`          |
| `CLIENT_CREDENTIALS`      | `"CLIENT_CREDENTIALS"`      |
| `HL7`                     | `"HL7"`                     |
| `SCOPE`                   | `"scope"`                   |
| `ACCESS_TOKEN`            | `"access_token"`            |

## OAuth client authentication types

How a confidential client presents its secret.

**Where you meet them.** In the client authentication selection on an OAuth client, which decides how that client presents its secret. Both:

`BASIC_HTTP` `REQUEST_BODY`

## OAuth client assertion types

Assertion-based client authentication, separate from the secret mechanism above.

**Where you meet them.** In the assertion-type selection on an OAuth client, and in the `client_assertion_type` parameter of the token request that client sends. All 3:

| Value            | What it carries                                                                    |
| ---------------- | ---------------------------------------------------------------------------------- |
| `JWT_BEARER`     | `"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"`                         |
| `DEVICE_TOKEN`   | `"org:openiam:params:oauth:client-assertion-type:x-openiam-firebase-device-token"` |
| `DEFAULT_CLIENT` | `"default-client"`                                                                 |

## Approver association types

Who an approval step can resolve to.

**Where you meet them.** In the association-type selection when you create an approver association, and as that association's stored type in `APPROVER_ASSOC`. All 15:

| Value                   | What it carries                                |
| ----------------------- | ---------------------------------------------- |
| `USER`                  | `"USER", true, true, false`                    |
| `SUPERVISOR`            | `"SUPERVISOR", true, true, false`              |
| `ROLE`                  | `"ROLE", true, true, true`                     |
| `GROUP`                 | `"GROUP", true, true, true`                    |
| `TARGET_USER`           | `"TARGET_USER", false, true, false`            |
| `RESOURCE`              | `"RESOURCE", false, false, true`               |
| `ORGANIZATION`          | `"ORGANIZATION", false, false, true`           |
| `OWNER`                 | `"OWNER", true, true, false`                   |
| `ADMIN`                 | `"ADMIN", true, true, false`                   |
| `APPLICATION_OWNER`     | `"APPLICATION_OWNER", false, false, false`     |
| `APPLICATION_ADMIN`     | `"APPLICATION_ADMIN", false, false, false`     |
| `ENTITLEMENT_OWNER`     | `"ENTITLEMENT_OWNER", false, false, false`     |
| `ENTITLEMENT_ADMIN`     | `"ENTITLEMENT_ADMIN", false, false, false`     |
| `SERVICE_ACCOUNT_OWNER` | `"SERVICE_ACCOUNT_OWNER", false, false, false` |
| `CERTIFICATION`         | `"CERTIFICATION", false, false, true`          |

## Workflow variables

Process variable names used by the shipped approval workflows.

**Where you meet them.** In the variables listed on a request's detail screen, and in the variable history Activiti keeps for a running or stuck process — which is what you collect when a request will not move. The name in the second column is the one you match against, both on the screen and in the history; note that several do not follow the constant's spelling, and two carry a misspelling the product ships and you therefore have to match exactly — `ApproverCardindality` and `TermintedByOwner`. All 72:

| Value                         | Activiti variable name     |
| ----------------------------- | -------------------------- |
| `COMMENT`                     | `Comment`                  |
| `REQUEST`                     | `Request`                  |
| `IS_TASK_APPROVED`            | `IsTaskApproved`           |
| `IS_REVIEW_COMPLETE`          | `IsReviewComplete`         |
| `NEW_USER_ID`                 | `NewUserId`                |
| `CANDIDATE_USERS_IDS`         | `candidateUsersIds`        |
| `TASK_NAME`                   | `TaskName`                 |
| `TASK_DESCRIPTION`            | `TaskDescription`          |
| `DUE_DATE`                    | `DueDate`                  |
| `REQUESTOR`                   | `TaskOwner`                |
| `REQUESTOR_NAME`              | `TaskOwnerName`            |
| `EXECUTOR_ID`                 | `ExecutorId`               |
| `APPROVER_ASSOCIATION_IDS`    | `ApproverAssociationIds`   |
| `ASSOCIATION_ID`              | `AssociationId`            |
| `ASSOCIATION_TYPE`            | `AssociationType`          |
| `IS_ADMIN`                    | `IsAdmin`                  |
| `IS_COMPLETE`                 | `IsComplete`               |
| `MEMBER_ASSOCIATION_ID`       | `MemberAssociationId`      |
| `ACCESS_RIGHTS`               | `AccessRights`             |
| `MEMBER_ASSOCIATION_TYPE`     | `MemberAssociationType`    |
| `APPROVER_CARDINALITY`        | `ApproverCardindality`     |
| `APPROVER_LEVEL`              | `ApproverLevel`            |
| `ESCALATION_LEVEL`            | `EscalationLevel`          |
| `COUNT_APPROVER_STEPS`        | `CountOfApproverSteps`     |
| `REQUEST_METADATA_MAP`        | `RequestMetadataMap`       |
| `CUSTOM_APPROVER_IDS`         | `CustomApproverIds`        |
| `GROUP_ID`                    | `GroupId`                  |
| `WORKFLOW_NAME`               | `WorkflowName`             |
| `LOGIN`                       | `Login`                    |
| `AUDIT_LOG_ID`                | `AuditLogId`               |
| `ASSIGNEE_ID`                 | `AssigneeUserId`           |
| `TERMINATED_BY_OWNER`         | `TermintedByOwner`         |
| `STATUS`                      | `STATUS`                   |
| `CLAIMED`                     | `CLAIMED`                  |
| `CLAIMED_DATE`                | `CLAIMED_DATE`             |
| `LOOP_COUNTER`                | `loopCounter`              |
| `CARDINALITY_OBJECT`          | `cardinalityObject`        |
| `RESOURCE`                    | `Resource`                 |
| `RESOURCE_IDS`                | `ResourceIds`              |
| `GROUP`                       | `Group`                    |
| `ROLE`                        | `Role`                     |
| `ORGANIZATION`                | `Organization`             |
| `CANDIDATE_USER_IDS`          | `CandidateUserIds`         |
| `PROCESS_START_DATE`          | `ProcessStartDate`         |
| `START_DATE`                  | `StartDate`                |
| `END_DATE`                    | `EndDate`                  |
| `USER_NOTE`                   | `UserNotes`                |
| `QUESTIONNAIRE`               | `Questionnaire`            |
| `TASK_HISTORY`                | `TASK_HISTORY`             |
| `REQUEST_ID`                  | `RequestId`                |
| `ASSOCIATION_HIS_ID`          | `AssociationHisId`         |
| `PARENT_PROCESS_INSTANCE_ID`  | `ParentProcessInstanceId`  |
| `REQUESTED_RESOURCES`         | `RequestedResources`       |
| `PARENT_APPROVER_STEPS`       | `ParentApproveSteps`       |
| `STEPS_OF_APPROVE`            | `StepsOfApprove`           |
| `REQUESTED_RESOURCES_HIS`     | `RequestedResources`       |
| `PARENT_STEPS_OF_APPROVE`     | `ParentStepsOfApprove`     |
| `EMAIL_TEMPLATE`              | `EmailTemplate`            |
| `SEND_NEXT_REMINDER_ON`       | `SendNextReminderOn`       |
| `NUMBER_REMINDERS_TO_SEND`    | `NumberRemindersToSend`    |
| `NUMBER_DAYS_BEFORE_REMINDER` | `NumberDaysBeforeReminder` |
| `TARGET_USER`                 | `TargetUser`               |
| `TARGET_USER_DISPLAY_NAME`    | `TargetUserDisplayName`    |
| `ORIGINAL_USER`               | `OriginalUser`             |
| `CHANGED_VALUES_MAP`          | `ChangedValuesMap`         |
| `SOURCE`                      | `Source`                   |
| `CAMPAIGN_ID`                 | `CampaignId`               |
| `CERTIFICATION_ID`            | `CertificationId`          |
| `VIOLATED_POLICY_IDS`         | `ViolatedPolicyIds`        |
| `EXPIRE_REASON`               | `ExpireReason`             |
| `EXTEND_REASON`               | `ExtendReason`             |
| `CASCADE_EXTENSION_IN_DAYS`   | `CascadeExtensionInDays`   |

## Segregation-of-duties severity

**Where you meet them.** In the **Severity** field on a segregation-of-duties rule, and as a column in the SoD report. Both:

| Value  | What it carries |
| ------ | --------------- |
| `SOFT` | `"SOFT"`        |
| `HARD` | `"HARD"`        |

## Segregation-of-duties risk levels

**Where you meet them.** In the risk-level field on a segregation-of-duties rule. All 3:

| Value      | What it carries |
| ---------- | --------------- |
| `CRITICAL` | `"CRITICAL"`    |
| `HIGH`     | `"HIGH"`        |
| `MEDIUM`   | `"MEDIUM"`      |

## Segregation-of-duties entitlement types

**Where you meet them.** In the entitlement-type selection when you add an entitlement to either side of a segregation-of-duties rule. All 5:

| Value          | What it carries  |
| -------------- | ---------------- |
| `ROLE`         | `"ROLE"`         |
| `GROUP`        | `"GROUP"`        |
| `RESOURCE`     | `"RESOURCE"`     |
| `ORGANIZATION` | `"ORGANIZATION"` |
| `ENTITLEMENT`  | `"ENTITLEMENT"`  |

## Segregation-of-duties rule-set status

The enforcement ladder for a rule set.

**Where you meet them.** As the status shown on a segregation-of-duties rule set, which is what decides whether a violation is only reported or actually blocked. All 3:

| Value      | What it carries |
| ---------- | --------------- |
| `INACTIVE` | `"INACTIVE"`    |
| `SHADOW`   | `"SHADOW"`      |
| `ENFORCED` | `"ENFORCED"`    |

## Segregation-of-duties entitlement match status

**Where you meet them.** As the per-entitlement result on an evaluated segregation-of-duties rule set. All 4:

| Value          | What it carries  |
| -------------- | ---------------- |
| `MATCHED`      | `"MATCHED"`      |
| `WILL_CREATE`  | `"WILL_CREATE"`  |
| `AMBIGUOUS`    | `"AMBIGUOUS"`    |
| `NEEDS_MANUAL` | `"NEEDS_MANUAL"` |

## Segregation-of-duties report fields

**Where you meet them.** As the column names of the segregation-of-duties report output, including its export. All 20:

| Value                       | What it carries               |
| --------------------------- | ----------------------------- |
| `USER_ID`                   | `"USER_ID"`                   |
| `USER_FIRST_NAME`           | `"USER_FIRST_NAME"`           |
| `USER_LAST_NAME`            | `"USER_LAST_NAME"`            |
| `USER_EMAIL`                | `"USER_EMAIL"`                |
| `USER_EMPLOYEE_ID`          | `"USER_EMPLOYEE_ID"`          |
| `USER_IDENTITY`             | `"USER_IDENTITY"`             |
| `USER_MANAGER`              | `"USER_MANAGER"`              |
| `USER_ORGANIZATION`         | `"USER_ORGANIZATION"`         |
| `SOD_POLICY_ID`             | `"SOD_POLICY_ID"`             |
| `SOD_POLICY_NAME`           | `"SOD_POLICY_NAME"`           |
| `SOD_POLICY_DESCRIPTION`    | `"SOD_POLICY_DESCRIPTION"`    |
| `SOD_POLICY_SEVERITY`       | `"SOD_POLICY_SEVERITY"`       |
| `SOD_POLICY_RISK`           | `"SOD_POLICY_RISK"`           |
| `SOD_POLICY_THRESHOLD`      | `"SOD_POLICY_THRESHOLD"`      |
| `SOD_POLICY_MANAGER_GROUP`  | `"SOD_POLICY_MANAGER_GROUP"`  |
| `SOD_SEGMENT_MANAGER_GROUP` | `"SOD_SEGMENT_MANAGER_GROUP"` |
| `SOD_SEGMENT_DESCRIPTION`   | `"SOD_SEGMENT_DESCRIPTION"`   |
| `SOD_MITIGATING_CONTROL`    | `"SOD_MITIGATING_CONTROL"`    |
| `USER_IS_MC_MANAGER`        | `"USER_IS_MC_MANAGER"`        |
| `USER_IS_MC_OWNER`          | `"USER_IS_MC_OWNER"`          |

## Certification campaign types

**Where you meet them.** In the campaign type selection when you create an access certification campaign; the type cannot be changed once the definition has been saved. All 2:

| Value                       | What it carries               |
| --------------------------- | ----------------------------- |
| `APPLICATION_CERTIFICATION` | `"APPLICATION_CERTIFICATION"` |
| `USER_CERTIFICATION`        | `"USER_CERTIFICATION"`        |

Risk is **not** a campaign type. It narrows either of these two through the certification's membership risk score. A third value, `RISK_EVENT_DRIVEN_CERTIFICATION`, was removed in 2026.9.1 — it was a user certification plus an identity-risk filter, and that filter was retired at the same time. Exports taken from 2026.9.0 or earlier can still carry it.

## Certification user selection modes

**Where you meet them.** In the user-selection mode on a certification campaign, which decides whose access the campaign pulls in. All 6:

`USER` `USER_ROLE` `USER_GROUP` `USER_TYPE` `USER_ORG` `EXTENDED_SEARCH`

## Certification report types

**Where you meet them.** In the report selection on a certification campaign. All 3:

| Value                  | What it carries          |
| ---------------------- | ------------------------ |
| `SCOPE_REPORT`         | `"SCOPE_REPORT"`         |
| `RESULT_REPORT`        | `"RESULT_REPORT"`        |
| `CURRENT_STATE_REPORT` | `"CURRENT_STATE_REPORT"` |

## Campaign preview status

**Where you meet them.** As the status against each row of a campaign preview, before you launch it. All 8:

`PENDING` `RUNNING` `COMPLETED` `CANCELLED` `FAILED` `LAUNCHING` `LAUNCHED` `LAUNCH_FAILED`

## Campaign preview exclusion reasons

Why an in-scope object was dropped from a campaign preview.

**Where you meet them.** As the reason given against an object the campaign preview dropped — the only place OpenIAM explains why something you expected to be certified is not in scope. All 22:

| Value                                   | What it carries             |
| --------------------------------------- | --------------------------- |
| `NO_APPROVER_ASSOCIATION`               | `Stage.SCOPE_FILTER`        |
| `NO_SCOPE_MATCH`                        | `Stage.SCOPE_FILTER`        |
| `NO_RISK_EVENTS`                        | `Stage.SCOPE_FILTER`        |
| `ROLE_EXCLUDED`                         | `Stage.SCOPE_FILTER`        |
| `GROUP_EXCLUDED`                        | `Stage.SCOPE_FILTER`        |
| `ZERO_REMAINING_ENTITLEMENTS`           | `Stage.SCOPE_FILTER`        |
| `NO_ENTITLEMENTS`                       | `Stage.SCOPE_FILTER`        |
| `ENTITLEMENT_START_FUTURE`              | `Stage.SCOPE_FILTER`        |
| `ENTITLEMENT_END_PAST`                  | `Stage.SCOPE_FILTER`        |
| `ENTITLEMENT_EXCLUDED_TAG`              | `Stage.SCOPE_FILTER`        |
| `ENTITLEMENT_PENDING_MANUAL_ASSIGNMENT` | `Stage.SCOPE_FILTER`        |
| `SUPERVISOR_NOT_FOUND`                  | `Stage.REVIEWER_RESOLUTION` |
| `ENTITLEMENT_OWNER_NOT_FOUND`           | `Stage.REVIEWER_RESOLUTION` |
| `ENTITLEMENT_ADMIN_NOT_FOUND`           | `Stage.REVIEWER_RESOLUTION` |
| `APPLICATION_OWNER_NOT_FOUND`           | `Stage.REVIEWER_RESOLUTION` |
| `APPLICATION_ADMIN_NOT_FOUND`           | `Stage.REVIEWER_RESOLUTION` |
| `GROUP_REVIEWER_EMPTY`                  | `Stage.REVIEWER_RESOLUTION` |
| `ORGANIZATION_CERTIFIER_NOT_FOUND`      | `Stage.REVIEWER_RESOLUTION` |
| `USER_NOT_FOUND`                        | `Stage.REVIEWER_RESOLUTION` |
| `OWNER_OF_SERVICE_ACCOUNT_NOT_FOUND`    | `Stage.REVIEWER_RESOLUTION` |
| `SCOPE_FILTER`                          | —                           |
| `REVIEWER_RESOLUTION`                   | —                           |

## Action on request expiry

**Where you meet them.** In the expiry-action field on the approval configuration that governs a request, deciding what happens when nobody acts in time. All 3:

| Value                                | What it carries                        |
| ------------------------------------ | -------------------------------------- |
| `DO_NOTHING`                         | `"DO_NOTHING"`                         |
| `REVOKE_ALL_ACCESS`                  | `"REVOKE_ALL_ACCESS"`                  |
| `REVOKE_ONLY_ALREADY_REVOKED_ACCESS` | `"REVOKE_ONLY_ALREADY_REVOKED_ACCESS"` |

## Search index names

The OpenSearch/Elasticsearch indexes OpenIAM maintains.

**Where you meet them.** As the index names your search cluster reports, and as the selection when you reindex. All 32:

| Value                             | What it carries                       |
| --------------------------------- | ------------------------------------- |
| `USER_ATTRIBUTES`                 | `"userattributes"`                    |
| `USERS`                           | `"users"`                             |
| `USER_RECALCULATION_DOC`          | `"user-recalculation"`                |
| `USER_VIOLATED_SOD_POLICY`        | `"user-violated-sod-policy"`          |
| `ORPHAN`                          | `"orphan"`                            |
| `EMAIL`                           | `"email"`                             |
| `AUDIT_LOG_TARGETS`               | `"auditlogtargets"`                   |
| `AUDIT_LOG`                       | `"auditlog"`                          |
| `AUDIT_LOG_ATTRIBUTE`             | `"auditlogattribute"`                 |
| `PHONE`                           | `"phone"`                             |
| `LOGIN`                           | `"logins"`                            |
| `CONNECTOR_REPLY`                 | `"connectorreply"`                    |
| `PROVISION_STREAM`                | `"provisionstream"`                   |
| `CONTACT_INFO`                    | `"contacts"`                          |
| `IDENTITY`                        | `"identity"`                          |
| `LOCATION`                        | `"location"`                          |
| `ROLE`                            | `"role"`                              |
| `MANAGED_SYS`                     | `"managedsystem"`                     |
| `GROUP_ATTRIBUTES`                | `"groupattributes"`                   |
| `GROUP`                           | `"group"`                             |
| `RESOURCE_ATTRIBUTES`             | `"resourceattributes"`                |
| `RESOURCE`                        | `"resource"`                          |
| `GROOVY_SCRIPT`                   | `"groovyscript"`                      |
| `ORGANIZATION`                    | `"organization"`                      |
| `METADATA_TYPE`                   | `"metadatatype"`                      |
| `URI_FEDERATION_STATISTIC`        | `"urifederationstatistic"`            |
| `PROVISION_REQUEST_DOC`           | `"provisionrequest"`                  |
| `PROVISION_CONNECTOR_REQUEST_DOC` | `"provisionconnectorrequest"`         |
| `INCOMPLETE_SELF_REG`             | `"incomplete-self-registration"`      |
| `INCOMPLETE_SELF_REG_USER`        | `"incomplete-self-registration-user"` |
| `RECO_SYNCH_INFO_STORAGE`         | `"reconsynchstorage"`                 |
| `RECON_SYNCH_INFO_STORAGE_OBJ`    | `"reconsynchstorageobject"`           |

## One-time-password provider types

**Where you meet them.** In the **Type** drop-down when you add a one-time-password provider. See [SMS and one-time passwords](/administration-guide/platform/sms-and-otp.md). All 5:

| Value             | What it carries |
| ----------------- | --------------- |
| `TWILIO_TEXT`     | `SMS`           |
| `TWILIO_VOICE`    | `VOICE`         |
| `SMS_GLOBAL_TEXT` | `SMS`           |
| `EMAIL_TEXT`      | `EMAIL`         |
| `GROOVY`          | `SMS`           |

## URI pattern match modes

**Where you meet them.** In the match-mode selection on a URI pattern, deciding how strictly the pattern has to match a request path. All 4:

| Value             | What it carries        |
| ----------------- | ---------------------- |
| `IGNORE`          | `0, "IGNORE"`          |
| `NO_PARAMS`       | `1, "NO_PARAMS"`       |
| `SPECIFIC_PARAMS` | `3, "SPECIFIC_PARAMS"` |
| `ANY_PARAMS`      | `2, "ANY_PARAMS"`      |

## Managed-system attribute names

Attribute rows the provisioning service actually consumes.

**Where you meet them.** As the **Name** of an attribute row on a managed system. Only these two names are consumed — an attribute row named anything else is stored and ignored, with no warning. Both:

| Value          | What it carries  |
| -------------- | ---------------- |
| `PRE_PROCESS`  | `"PRE_PROCESS"`  |
| `POST_PROCESS` | `"POST_PROCESS"` |

## Business rule expression attributes

Identity attributes a business rule condition can test. Note that several are IDs, not display values.

**Where you meet them.** In the attribute drop-down when you build a business rule condition. All 46:

`ADDRESSES` `BIRTHDATE` `COMPANY_OWNER_ID` `CREATE_DATE` `CREATED_BY` `EMAIL_ADDRESSES` `EMPLOYEE_ID` `EMPLOYEE_TYPE_ID` `FIRST_NAME` `JOB_CODE_ID` `LAST_NAME` `LAST_UPDATE` `LAST_UPDATED_BY` `LOCATION_CD` `LOCATION_NAME` `CLASSIFICATION` `MIDDLE_INIT` `PHONES` `PREFIX` `SEX` `STATUS` `SECONDARY_STATUS` `SUFFIX` `TITLE` `USER_ATTRIBUTES` `USER_TYPE_IND` `COST_CENTER` `START_DATE` `LAST_DATE` `CLAIM_DATE` `MAIL_CODE` `NICKNAME` `MAIDEN_NAME` `PRINCIPAL_LIST` `ALTERNATE_CONTACT_ID` `ALTERNATIVE_START_DATE` `ALTERNATIVE_END_DATE` `ROLES` `RESOURCES` `GROUPS` `AFFILIATIONS` `PARTNER_NAME` `PREFIX_LAST_NAME` `PREFIX_PARTNER_NAME` `USER_SUB_TYPE_ID` `TYPE_ID`

## Business rule action types

**Where you meet them.** In the action drop-down when you add an action to a business rule. All 27:

| Value                             | What it carries     |
| --------------------------------- | ------------------- |
| `ENABLE`                          | —                   |
| `DISABLE`                         | —                   |
| `ACTIVATE`                        | —                   |
| `DEACTIVATE`                      | —                   |
| `LOCK`                            | —                   |
| `GROOVY`                          | —                   |
| `ADD_ROLE`                        | —                   |
| `REMOVE_ROLE`                     | —                   |
| `ADD_GROUP`                       | —                   |
| `REMOVE_GROUP`                    | —                   |
| `ADD_RESOURCE`                    | —                   |
| `REMOVE_RESOURCE`                 | —                   |
| `ADD_ORG`                         | —                   |
| `REMOVE_ORG`                      | —                   |
| `END_DATE_ALL_ACCESS`             | —                   |
| `RESTORE_ALL_ACCESS`              | —                   |
| `PROLONG_ALL_ACCESS`              | —                   |
| `DROP_ALL_ENTITLEMENTS`           | —                   |
| `TRANSITION`                      | `SELF_REGISTRATION` |
| `TRIGGER_CREATE_WITHOUT_APPROVAL` | `SELF_REGISTRATION` |
| `TRIGGER_CREATE_WITH_APPROVAL`    | `SELF_REGISTRATION` |
| `ADD_ROLE_ACCESS_REQUEST`         | —                   |
| `REMOVE_ROLE_ACCESS_REQUEST`      | —                   |
| `ADD_GROUP_ACCESS_REQUEST`        | —                   |
| `REMOVE_GROUP_ACCESS_REQUEST`     | —                   |
| `ADD_ATTRIBUTE`                   | —                   |
| `REMOVE_ATTRIBUTE`                | —                   |

## Consent renewal frequency

**Where you meet them.** In the renewal-frequency field on an IT policy, deciding how often a user is asked to consent again. See [Consent and IT policy](/administration-guide/consent/consent-and-it-policy.md). All 3:

| Value          | What it carries  |
| -------------- | ---------------- |
| `ONCE`         | `"once"`         |
| `SEMIANNUALLY` | `"semiannually"` |
| `ANNUALLY`     | `"annually"`     |

## Metadata type groupings

**Where you meet them.** In the **Grouping** drop-down when you create or edit a metadata type; the grouping is what decides which screens offer that type. All 42:

| Value                                | What it carries |
| ------------------------------------ | --------------- |
| `OBJECT_TYPE`                        | `true`          |
| `USER_EMPLOYEE_TYPE`                 | `true`          |
| `OPERATION`                          | `true`          |
| `PHONE`                              | `true`          |
| `UI_WIDGET`                          | `true`          |
| `APPLICATION_CATEGORY`               | `true`          |
| `APPLICATION`                        | `true`          |
| `USER`                               | `false`         |
| `USER_2ND_STATUS`                    | `false`         |
| `ADDRESS`                            | `true`          |
| `EMAIL`                              | `true`          |
| `KERB_AUTH_LEVEL`                    | `true`          |
| `CERT_AUTH_LEVEL`                    | `true`          |
| `JOB_CODE`                           | `true`          |
| `SERVICE_STATUS`                     | `true`          |
| `GROUP_TYPE`                         | `true`          |
| `ROLE_TYPE`                          | `true`          |
| `ORG_TYPE`                           | `true`          |
| `RESOURCE_TYPE`                      | `true`          |
| `USER_OBJECT_TYPE`                   | `true`          |
| `GROUP_CLASSIFICATION`               | `true`          |
| `AD_GROUP_TYPE`                      | `false`         |
| `AD_GROUP_SCOPE`                     | `false`         |
| `AFFILIATIONS`                       | `true`          |
| `USER_SUB_TYPES`                     | `true`          |
| `RISK`                               | `true`          |
| `PROV_OBJECT`                        | `true`          |
| `OAUTH_CLIENT_AUTH_TYPE`             | `false`         |
| `OAUTH_AUTH_GRANT`                   | `false`         |
| `OAUTH_SIGN_ALG`                     | `false`         |
| `SUPERVISOR_TYPE`                    | `true`          |
| `PAGE_TEMPLATE_TYPE`                 | `true`          |
| `MAIL_TEMPLATE`                      | `true`          |
| `SOURCE_ADAPTER`                     | `true`          |
| `LOGIN_ATTRIBUTE_TYPE`               | `true`          |
| `RELATED_ACCOUNT_ASSOCIATION_TYPE`   | `true`          |
| `EXTERNAL_AUTH_LEVEL`                | `true`          |
| `OAUTH_CLIENT_ASSERTION_TYPE`        | `false`         |
| `ANALYTICS_DASHBOARD_TILE_TYPE`      | `false`         |
| `ANALYTICS_DASHBOARD_TILE_ATTR_TYPE` | `true`          |
| `MEMBERSHIP_TAG`                     | `true`          |
| `SOD_RISK`                           | `true`          |

## Related

* [Shipped approval workflows](/administration-guide/reference/shipped-workflows.md) — which definition reads which workflow variable
* [Configure reconciliation](/administration-guide/lifecycle/configure-reconciliation.md) — the situation-to-response matrix these values fill
* [Build a business rule](/administration-guide/access/business-rules.md) — where the expression attributes and action types are offered
* [Object model](/administration-guide/start/object-model.md) — metadata types, and the groupings that place them

*Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/reference/enums.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.