# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The OnGuard connector uses the following default correlation and object configurations.

This section describes the different schema attributes.

> [!NOTE]
>
> - The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued.
> - The identity attribute is predefined in the schema. Do not change the native identity (primary) attribute during aggregation. If the value is altered, it may result in errors in your database. Refer to Account ID for the default values.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| ID | Cardholder |
| ID | Badge Type |
| ID | Access Level |

### Default Account Attributes

The OnGuard connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| ID | The cardholder's unique ID. This is an Account ID which must not be changed. |
| First Name | The cardholder's first name. |
| Last Name | The cardholder's last name. |
| Middle Name | The cardholder's middle name. |
| Primary Segment | Primary Segment of a cardholder. This attribute will be visible only when segmentation is enabled . |
| Additional Segments | Additional Segments of a cardholder. This attribute will be visible only when segmentation is enabled. |
| Email Address | The cardholder's email address. |
| City | The cardholder's city. |
| State | The cardholder's state. |
| Location | The name of the cardholder's location. |
| Title | The cardholder's title. |
| Office Phone | The cardholder's office phone number. |
| Allowed Visitors | Indicates if the cardholder is allowed to have visitors. |
| Building | The cardholder's building. |
| Department | The cardholder's department. |
| Division | The cardholder's division. |
| Extension | The cardholder's phone extension. |
| Floor | The floor that the cardholder is assigned to. |
| Last Changed | Timestamp for the most recent change to the record. |
| Badge Types | List of active badge types assigned to cardholders. |
| Badges | List of active badges assigned to the cardholder. |
| Inactive Badges | List of inactive badges assigned to the cardholder. |
| Access Levels | List of active access levels assigned to the cardholder. |
| Inactive Access Levels | List of inactive access levels assigned to cardholder. |

### Custom Attributes

Configure the connector to include custom attributes from the source in account aggregation processes. To include additional custom attributes in the account aggregation processes, add the attribute name to the account schema exactly as it is configured in the source schema.

Along with the attributes above, you can aggregate customer-specific custom cardholder attributes. Add each custom attribute to the account schema using its OnGuard internal field name, for example, `CUSTOM_ATTR`, and not the label shown on the OnGuard form.

After you add a custom attribute to the schema, the connector returns it during full aggregation, delta aggregation, and single account read. The connector ignores custom attributes that you do not add to the schema, and aggregation does not fail.

For date custom attributes, add the attribute as type `string`. The connector detects date fields from OnGuard and returns the same value for full aggregation, delta aggregation, and single account read. Dates are returned in ISO-8601 format in the connector time zone, for example, `1989-01-01T05:30:00+05:30`.

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The OnGuard connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

#### Object Type: Badge Type

| Attribute Name | Description |
| --- | --- |
| ID | The Badge Type's unique internal database ID. This is an Account ID which must not be changed. |
| Badge ID Allocation Type | Indicates the method by which the Badge ID field on the Badge Form is automatically filled in when adding a new badge. |
| Badge ID Allow Edit | Indicates if badges which use this Badge Type have editable IDs. |
| Badge Type Class | The Badge Type's class. |
| Default Access Group | The name of the group to which the access levels belong. |
| Default Deactivation Date | The default deactivation date for any badges which use this Badge Type. |
| Default Deactivation Date Type | Indicates the type or class, assigned to this Badge Type. |
| First Issue Code | The Badge Type's optional first issue code. |
| Is Disposable | Used by Visitor-type badges, indicates if the badge can be disposed of. |
| Name | The Badge Type's name. |
| Use Latest Badge Deactivation Date | Indicates if the latest deactivation date can be used. |
| Use Mobile Credential | Indicates if mobile credentialing is enabled. |
| Segment | Segment to which the badge type belongs. |

#### Object Type: Access Level

| Attribute Name | Description |
| --- | --- |
| ID | The access level's unique internal database ID. This is an Account ID which must not be changed. |
| Name | The access level's display name. |
| Available For Request | Indicates if the access level can be requested. |
| Download To Intelligent Readers | Indicates if the access level can be downloaded to intelligent readers. |
| First Card Unlock | First card unlocks the reader. |
| Has Command Authority | Indicates if the access level has Command authority. |
| Segment | Segment to which the badge type belongs. |