When an administrator attempts to create an Access Request via the Okta Identity Governance (OIG) API /governance/api/v2/requests endpoint or the OIG Create request Workflows card, there is an issue creating the request.

The API response includes the following error during the request creation attempt:

"errorSummary": "Catalog entry entryId='cen...' is not requestable."

errorCauses: [
{
{
"errorSummary": "Catalog entry entryId='cen...' is not requestable."
}
}
]

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows
• Okta Identity Governance (OIG)
• RCAR
  
• OIG Access Requests V2 API

The API call that generates that error response is requesting a parent application (or an invalid entry) that cannot be requested. Only the associated child entry is able to be requested. 

To verify it is a parent entry:

• When running a GET against the catalog ID in the error with /governance/api/v2/catalogs/default/entries?filter=parent eq "<parent_id>"&limit=20  (replacing <parent_id> with the ID from the error), the API response will show "requestable": false which would indicate it is a parent. If it were a child entry, then it would be "requestable": true.

Okta Identity Governance structures catalog entries using a parent-child relationship. Here is a representation of this structure:

• A parent entry represents the top-level application and cannot be requested.
  • In the End-User Dashboard, when navigating to Request access, the displayed applications represent the parent catalog entries. 
• A child entry represents a specific access level or "condition" and contains a requestable attribute set to true.
  • Selecting an application tile from the Request access view reveals the specific requestable conditions, which represent the child entries that are used to create the requests.

How is the OIG API error Catalog Entry Is Not Requestable resolved when creating an Access Request?

Locate the requestable child entry id using the Okta API or Okta Workflows, and then update the API request to use this child id.

Here are a couple of options to find the (requestable) child id:

How is the child entry located via Okta API?

Query the catalogs endpoint using a filter to find the child entries associated with the parent ID.

1. Identify the parent entry ID from the initial error message.
2. Execute a GET request to the endpoint, replacing <parent_id> with the actual parent entry ID.

   /governance/api/v2/catalogs/default/entries?filter=parent eq "<parent_id>"&limit=20

3. Locate the id of the child entry in the response where the field requestable equals true.
4. Update the /governance/api/v2/requests API call to use this child catalog ID.

How is the child entry located via the Okta Workflows Card without using a Custom API Action?

Retrieve the requestable child entry ID by providing the parent ID to the Okta Identity Governance List requestable access levels card.

1. Identify the parent entry ID from the initial error message or the List requestable resources card.
2. Using the List Requestable Access Levels card, enter the parent entry ID (cen...) into the ID input field.

3. Run the card and extract the child entry id (cen...) from the card output.
   • NOTE: requestable is set to true in the response (indicating it is a requestable item).

4. Update the request creation to use the extracted child entry ID.

Related References

• OIG Catalogs API