SailPoint

MANUAL DESCRIPTION

The SailPoint integration connects Sim workflows to SailPoint Identity Security Cloud (ISC) with a Personal Access Token (PAT). Enter the tenant name from your ISC URL—or the full *.api.identitynow.com / *.api.identitynowgov.com host—plus the PAT client ID and client secret. Sim exchanges those credentials at the tenant's /oauth/token endpoint and calls SailPoint's current service-versioned endpoints, such as /identities/v1, /access-requests/v1, and /certifications/v1. There is no global API-version setting.

Create the PAT with the least-privileged scopes required by the actions in your workflow. Common read scopes include sp:search:read, idn:identity:read, idn:accounts:read, idn:entitlement:read, idn:role-unchecked:read or idn:role-checked:read, idn:access-profile:read, idn:sources:read, idn:campaign:read, idn:access-request-status:read, idn:access-request-config:read, idn:task-management:read, and idn:access-request-approvals:read. SailPoint lists idn:access-request:manage and idn:access-request-self:manage for access-request submission, idn:access-request:create for account-selection discovery, idn:access-request:manage for cancellation, idn:campaign:manage for certification decisions and sign-off, idn:access-request-approvals:manage for approval actions, idn:sources:manage for account import, and idn:entitlement:manage for entitlement import and entitlement request configuration. Some identity-governance endpoints require a user-context PAT and an appropriate SailPoint user authority in addition to an OAuth scope; scopes never grant authority beyond the PAT owner's ISC permissions.

List actions return one bounded page. Standard collections accept up to 250 records per call; role collections accept up to 50; Search accepts up to 10,000. Use offset, sorters, or Search's searchAfter cursor to continue. Enable count only when you need the provider's X-Total-Count header. Omitting Search indices searches every index allowed by SailPoint; complex Search request fields are available as structured JSON inputs.

Access requests are asynchronous. A successful submission returns SailPoint's newRequests and existingRequests tracking records, including the access-request IDs needed by the status tools. The standard request form applies the same requested items to every identity; use requestedForWithRequestedItems when identities need different items, dates, forms, or account selections. Use Get Account Selections before a machine grant/modify or a human multi-account request, then copy the returned source/account selection into Request Access. Account-selection discovery accepts at most 25 flat requested items. An entitlement revoke is limited to one entitlement per request, while entitlement grants are limited to 25 entitlements and 10 identities. Sim also caps other request recipient/item arrays at 250 to keep execution payloads bounded.

Use Get Access Request Config to inspect the tenant's request-on-behalf-of and machine-identity settings. Use Get Entitlement Request Config to inspect one entitlement's grant, revocation, duration, approval, and form requirements before constructing a request. These configuration reads help a workflow avoid offering a request shape the tenant or entitlement does not permit.

Account and entitlement imports upload a CSV to a source and return a task that can be followed with Get Task Status. Sim caps each uploaded CSV at 25 MiB and does not automatically poll the task. The file must be available to the workflow owner, and the source must support the corresponding import operation.

The 40 actions cover six connected workflows: search and entity lookup; account, entitlement, role, access-profile, and source inventory; access-request configuration and account-selection discovery; access request submission, cancellation, approval, rejection, and status; campaign and certification review, decision, and sign-off; and CSV import plus task monitoring. Provider-defined objects such as account attributes and Search documents remain JSON because their fields depend on the tenant, source, index, and field projection.

Usage Instructions

Read and act on identity-governance data in SailPoint Identity Security Cloud (ISC) with a Personal Access Token (PAT) exchanged through OAuth2 client credentials at https://TENANT.api.identitynow.com/oauth/token. SailPoint versions each service independently, so the integration uses current service paths such as /search/v1, /identities/v1, and /access-requests/v1; there is no shared annual API-version setting. Use a PAT whose owner has the ISC user level required by each endpoint because many identity, role, access-profile, certification, approval, and access-request operations require user context in addition to scopes. Common read scopes include sp:search:read, idn:identity:read, idn:accounts:read, idn:entitlement:read, idn:role-unchecked:read or idn:role-checked:read, idn:access-profile:read, idn:sources:read, idn:campaign:read, idn:access-request-status:read, idn:access-request-config:read, idn:task-management:read, and idn:access-request-approvals:read. Mutations additionally use idn:sources:manage for account aggregation, idn:entitlement:manage for entitlement aggregation and entitlement request configuration, idn:campaign:manage for certification decisions and sign-off, the access-request scopes listed by SailPoint for request submission, idn:access-request:create for account-selection discovery, and idn:access-request-approvals:manage for approval actions. A scope alone does not grant authority beyond the PAT owner's ISC permissions, and authorization failures may be returned as provider errors or filtered visibility depending on the endpoint and tenant policy.

Actions

SailPoint Approve Access Request

Approve one pending access-request approval.

Input

Output

SailPoint Cancel Access Request

Cancel an access request that has not passed approval.

Input

Output

SailPoint Decide Certification Review Items

Approve or revoke 1-250 review items in an identity certification.

Input

Output

SailPoint Get Access Profile

Get an access profile by ID.

Input

Output

SailPoint Get Access Profile Entitlements

List entitlements in one access profile.

Input

Output

SailPoint Get Access Request Config

Get tenant access-request, request-on-behalf-of, and machine-identity configuration.

Input

Output

SailPoint Get Access Request Status

List requested-item status records for access requests.

Input

Output

SailPoint Get Account

Get an account from the current /accounts/v1 service by ID.

Input

Output

SailPoint Get Account Activity

Get an account activity by ID.

Input

Output

SailPoint Get Account Entitlements

List entitlements granted to one account.

Input

Output

SailPoint Get Account Selections

Resolve eligible source accounts before submitting a machine or multi-account access request.

Input

Output

SailPoint Get Campaign

Get a certification campaign by ID.

Input

Output

SailPoint Get Certification

Get an identity certification by ID.

Input

Output

SailPoint Get Entitlement

Get an entitlement by ID.

Input

Output

SailPoint Get Entitlement Request Config

Get grant, revocation, duration, approval, and form settings for an entitlement.

Input

Output

SailPoint Get Identity

Get an identity from the current /identities/v1 service by ID.

Input

Output

SailPoint Get Role

Get a role by ID.

Input

Output

SailPoint Get Role Entitlements

List entitlements in one role using the current non-experimental roles service.

Input

Output

SailPoint Get Source

Get an identity source by ID.

Input

Output

SailPoint Get Task Status

Get the current status of a SailPoint background task by ID.

Input

Output

SailPoint List Access Profiles

List access profiles with current visibility and segmentation controls.

Input

Output

SailPoint List Account Activities

List provisioning activities with identity, filter, sort, and page controls.

Input

Output

SailPoint List Accounts

List accounts with documented filtering, sorting, detail, and pagination.

Input

Output

SailPoint List Campaigns

List certification campaigns with detail, filtering, sorting, and pagination.

Input

Output

SailPoint List Certification Review Items

List access-review items in one identity certification.

Input

Output

SailPoint List Certifications

List identity certifications assigned to a reviewer.

Input

Output

SailPoint List Entitlements

List entitlements with current segmentation, cursor, filter, and page controls.

Input

Output

SailPoint List Identities

List identities with documented filtering, sorting, and pagination.

Input

Output

SailPoint List Identity Entitlements

List tagged entitlement references held by one identity.

Input

Output

SailPoint List Pending Access Request Approvals

List pending access-request approvals visible to the caller.

Input

Output

SailPoint List Roles

List roles with current visibility, segmentation, filtering, and pagination controls.

Input

Output

SailPoint List Sources

List identity sources with visibility, filtering, sorting, and pagination controls.

Input

Output

SailPoint Load Accounts

Start account aggregation for a source, optionally using a CSV file.

Input

Output

SailPoint Load Entitlements

Start entitlement aggregation for a source, optionally using a CSV file.

Input

Output

SailPoint Reject Access Request

Reject one pending access-request approval with a reviewer comment.

Input

Output

SailPoint Request Access

Submit a current human or machine identity access request.

Input

Output

SailPoint Search

Search current SailPoint indices with every documented search query mode.

Input

Output

SailPoint Search Aggregate

Run an Elasticsearch DSL or SailPoint aggregation over current search indices.

Input

Output

SailPoint Search Count

Count documents matching a complete SailPoint search body.

Input

Output

SailPoint Sign Off Certification

Sign off a completed identity certification.

Input

Output