# Schema Reference

Use these attributes to map Oracle Cloud Infrastructure (OCI) IAM users to SailPoint accounts. Group and policy attributes are listed on [Group Attributes](<#group-attributes>) and [Policy Attributes](<#policy-attributes>). Dataset resource attributes remain under [Supported Resources](<https://documentation.sailpoint.com/connectors/oracle/oci/saas/help/datasets.html#supported-resources>).

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Oracle Cloud Infrastructure SaaS connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account Attributes

The Oracle Cloud Infrastructure SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Account aggregation discovers Oracle Cloud Infrastructure (OCI) IAM users as accounts. The identity attribute is `id`. The display attribute is `name`.

> [!NOTE]
>
> Account names can differ by identity domain. Users in a non-default identity domain often appear with a domain prefix. Users in the default domain typically appear as an email address or user name only.

| Attribute | Type | Description |
| --- | --- | --- |
| `id` | string | Unique identifier for the account, in `{tenancy OCID}/{user OCID}` format. |
| `userId` | string | OCID of the IAM user. |
| `compartmentId` | string | Compartment OCID. For IAM users, this is the tenancy OCID. |
| `name` | string | User name. Uses the email address if the name is blank. |
| `email` | string | User email. |
| `description` | string | User description. |
| `emailVerified` | boolean | Indicates whether the email address is verified. |
| `isMfaActivated` | boolean | Indicates whether multifactor authentication (MFA) is enabled. |
| `identityProviderId` | string | OCID of the identity provider, if the user is federated. |
| `externalIdentifier` | string | Identifier from the identity provider. |
| `timeCreated` | string | Date and time the user was created. |
| `lifecycleState` | string | Current lifecycle state of the user. |
| `freeformTags` | string | Free-form tags. |
| `createdBy` | string | Email address or name of the user who created the account. |
| `capabilities` | string (multi-valued) | Capabilities enabled for the user. |
| `Groups` | string (multi-valued) | IAM groups this user belongs to. Each value links to a Group entitlement. |

## Group Attributes

OCI IAM groups aggregated as entitlements. The identity attribute is `id`. The display attribute is `name`.

| Attribute | Type | Description |
| --- | --- | --- |
| `compartmentId` | string | Compartment OCID that owns the group. For IAM groups, this is the tenancy OCID. |
| `definedTags` | string | Defined tags, stored as JSON. |
| `description` | string | Group description. |
| `freeformTags` | string | Free-form tags, stored as JSON. |
| `id` | string | Unique identifier for the group, in `IAM/{tenancy OCID}/{group OCID}` format. |
| `lifecycleState` | string | Group lifecycle state. |
| `name` | string | Group name. |
| `ocid` | string | Group OCID. |
| `PoliciesReferencedIn` | string (multi-valued) | IAM policies that refer to this group. Each value links to a Policy entitlement. |
| `PolicyStatementsReferredIn` | string (multi-valued) | IAM Authorization policy statements that reference this group. Each value is `<policy name>: <access>`, where `<access>` is the statement text after "to" (verb, resource, location, and any where condition). Example: `AdminsPolicy: inspect domains in tenancy`. |
| `timeCreated` | string | Date and time the group was created. |

## Policy Attributes

OCI IAM policies aggregated as entitlements. The identity attribute is `id`. The display attribute is `name`.

| Attribute | Type | Description |
| --- | --- | --- |
| `compartmentId` | string | Compartment OCID that owns the policy. |
| `definedTags` | string | Defined tags, stored as JSON. |
| `description` | string | Policy description. |
| `freeformTags` | string | Free-form tags, stored as JSON. |
| `GroupsReferred` | string (multi-valued) | Groups named in this policy. An OCI IAM group in this tenancy is a link to the Group entitlement. Any other reference is shown as text. |
| `id` | string | Unique identifier for the policy, in `IAM/{tenancy OCID}/{policy OCID}` format. |
| `lifecycleState` | string | Policy lifecycle state. |
| `name` | string | Policy name. |
| `ocid` | string | Policy OCID. |
| `statements` | string (multi-valued) | Policy statements, as written in OCI. |
| `timeCreated` | string | Date and time the policy was created. |
| `versionDate` | string | Policy version date. |