# Bookmark applications

Bookmark applications are assigned to users directly or through groups, and a user's access follows its group membership and status.

A bookmark application is a sign-in tile an org assigns to users and groups, and it is the application type the simulator models. Create one, assign the Design group to it, assign one user directly and deactivate the application:

```bash
curl -s -X POST "$RYSTIC_URL/_rystic/scenario" -d '{"name":"design_studio"}' -o /dev/null
api="$RYSTIC_URL/api/v1"
curl -s "$api/apps" -H 'Authorization: SSWS placeholder' -H 'Content-Type: application/json' -d '{"name":"bookmark","label":"Design Wiki","signOnMode":"BOOKMARK","settings":{"app":{"url":"https://wiki.wdcontractors.example","requestIntegration":false}}}' | jq -c '{id, label, status, signOnMode}'
# -> {"id":"0oa00000000000000001","label":"Design Wiki","status":"ACTIVE","signOnMode":"BOOKMARK"}
group=$(curl -s "$api/groups?q=Design" -H 'Authorization: SSWS placeholder' | jq -r '.[] | select(.profile.name == "Design") | .id')
curl -s -X PUT "$api/apps/0oa00000000000000001/groups/$group" -H 'Authorization: SSWS placeholder' -H 'Content-Type: application/json' -d '{"priority":0}' | jq -c '{priority}'
# -> {"priority":0}
curl -s "$api/apps/0oa00000000000000001/users" -H 'Authorization: SSWS placeholder' | jq -c 'map(.scope) | unique'
# -> ["GROUP"]
user=$(curl -s "$api/users?search=profile.department%20eq%20%22Design%22&limit=1" -H 'Authorization: SSWS placeholder' | jq -r '.[0].id')
curl -s "$api/apps/0oa00000000000000001/users" -H 'Authorization: SSWS placeholder' -H 'Content-Type: application/json' -d "{\"id\":\"$user\"}" | jq -c '{scope, status}'
# -> {"scope":"USER","status":"ACTIVE"}
curl -s -X POST "$api/apps/0oa00000000000000001/lifecycle/deactivate" -H 'Authorization: SSWS placeholder' -o /dev/null -w '%{http_code}\n'
# -> 200
curl -s "$api/apps/0oa00000000000000001" -H 'Authorization: SSWS placeholder' | jq -c '{status}'
# -> {"status":"INACTIVE"}
```

### Assignments

An application's users are listed at `/api/v1/apps/{appId}/users` and its groups at `/api/v1/apps/{appId}/groups`. Assigning a group gives each member a group-derived assignment (`scope` `GROUP`), and assigning a user directly gives a `USER` assignment. Assign a group with `PUT /api/v1/apps/{appId}/groups/{groupId}`, change it with `PATCH` and remove it with `DELETE`.

A user's assignments follow its status ([User lifecycle and passwords](https://www.rystic.ai/docs/simulators/okta/features/user-lifecycle.md)):

| The user is | What happens to its assignments |
|---|---|
| deactivated or purged | all are removed, direct and group-derived |
| activated again | the group-derived ones are restored, the direct ones aren't |

### Only bookmark applications are measured

**Differs from Okta:** an application with another sign-on mode is stored as you send it, without the credentials Okta would generate. It gets no OAuth `client_id` or secret and no SAML metadata.

---

Source: https://www.rystic.ai/docs/simulators/okta/features/applications · Markdown: https://www.rystic.ai/docs/simulators/okta/features/applications.md