# Automation Anywhere Provisioning Settings

This section contains the information used to create, update, enable, disable, and delete accounts by triggering RPA bots.

> [!IMPORTANT]
>
> Upload the bot to the Control Room before configuring its file ID. The connector cannot deploy a bot that exists on a local machine.

## Bot Execution Configuration

Configure User IDs and Pool IDs.

> [!NOTE]
>
> **Screenshot**
>
> [![User ID and Pool ID screenshot](<https://documentation.sailpoint.com/connectors/rpa/saas/help/img/userid_poolid.png>)](<https://documentation.sailpoint.com/connectors/rpa/saas/help/img/userid_poolid.png>)

1. In the **User IDs** field, enter one or more Automation Anywhere user IDs that the bot will run as. For more information, refer to [Run As User ID](<https://documentation.sailpoint.com/connectors/rpa/saas/help/automation_anywhere/automation_anywhere_prerequisites.html#run-as-user-id>).

   Find these IDs in your Automation Anywhere Control Room under **Administration \> Users**.
2. In the **Pool IDs** field, enter one or more device pool IDs to run the bot on specific devices. For more information, refer to [Device Pool ID (Optional)](<https://documentation.sailpoint.com/connectors/rpa/saas/help/automation_anywhere/automation_anywhere_prerequisites.html#device-pool-id-optional>).

   > **Note**
   >
   > To use the default device, leave the field empty.
3. Select **Save**.

## Operation Configuration

Configure which Automation Anywhere bots to trigger for each provisioning operation. You can find file IDs in the Automation Anywhere Control Room under **Automation \> Bots**. For more information, refer to [Bot File IDs](<https://documentation.sailpoint.com/connectors/rpa/saas/help/automation_anywhere/automation_anywhere_prerequisites.html#bot-file-ids>).

> [!NOTE]
>
> **Screenshot**
>
> [![Bot IDs screenshot](<https://documentation.sailpoint.com/connectors/rpa/saas/help/img/bot_ids.png>)](<https://documentation.sailpoint.com/connectors/rpa/saas/help/img/bot_ids.png>)

1. In the **CREATE Bot File ID** field, enter the bot file ID to trigger when creating new accounts.
2. In the **UPDATE Bot File ID** field, enter the bot file ID to trigger when updating accounts.
3. In the **ENABLE Bot File ID** field, enter the bot file ID to trigger when enabling accounts.
4. In the **DISABLE Bot File ID** field, enter the bot file ID to trigger when disabling accounts.
5. In the **DELETE Bot File ID** field, enter the bot file ID to trigger when deleting accounts.
6. Select **Save**.

## Advanced Polling Settings

Configure settings to adjust polling when connecting to the source. This may help resolve timeout errors that occur during provisioning operations.

> [!NOTE]
>
> **Screenshot**
>
> [![Polling settings screenshot](<https://documentation.sailpoint.com/connectors/rpa/saas/help/img/polling_settings.png>)](<https://documentation.sailpoint.com/connectors/rpa/saas/help/img/polling_settings.png>)

1. In the **Max Poll Attempts** field, enter the maximum number of times the connector should check the job status. If the job doesn't complete after the configured number of checks, it times out.
2. In the **Poll Interval in Seconds** field, enter the wait time between job status checks. Increase this value if your workflows take longer to complete.
3. Select **Save**.

## Operation-Specific Guidelines

This section provides detailed guidance for provisioning operations in the Automation Anywhere RPA platform.

### Best Practices

- **Return a clear result**: Always set `Status` and, on failure, set a `message` so Support can troubleshoot. The response should have the required attributes.
- **Always return `botOutVariables`**: The connector requires `botOutVariables` with `Status`. Set `Status: true` on success and `Status: false` on failure.
- **Return the created identity**: Always include the identity attribute in `Attributes` with the final value.
- **Idempotency**: If the same operation is retried, consider designing the target system or workflow so it does not create duplicates (e.g. "create if not exists" or use a stable identifier).
- **Errors**: On failure, set `Status: false` and put a short, user-friendly reason in `message`; avoid exposing sensitive details.
- **Logging**: Log input and outcome (success or failure) in Automation Anywhere for auditing and support; avoid logging secrets in plain text.
- **Atomic Operations** - If the create operation partially fails, for example if the account is created but role assignment fails:

  - **Option A**: Rollback the partially created account then set `Status = false`.
  - **Option B**: Complete what's possible, then set `Status = true`. Note the issue in a message.

  > **Note**
  >
  > SailPoint recommends that you roll back for consistency.
- **Apply set / add / remove correctly**: In the target system, implement `Set` as "replace value", `Add` as "append to list", `Remove` as "remove these values from list" so the behavior matches the connector's intent.
- **Return current state**: Prefer returning the updated account's attributes in `Attributes` (at least identity + any attributes your workflow changes) so the connector can merge and show up-to-date data.

### CREATE Operations

When the connector receives a Create Account request, it deploys a dedicated Automation Anywhere bot. The bot receives input, performs the account creation in the target system, and returns the result to the connector.

Configure the CREATE bot file ID in the connector configuration. The bot must be the one associated with that file ID in the Automation Anywhere Control Room.

#### Bot Input Variables

The connector sends input variables to the bot using the Automation Anywhere `/v3/automations/deploy` endpoint. Each variable is formatted as an Automation Anywhere typed variable.

**Variable Format**:

```text
{ "varName": { "type": "STRING", "string": "value" } }
```

The input contains one typed variable per attribute from the provisioning request. Names and sets of attributes depend on the account schema and what the request contains. For example, `Email`, `displayName`, `Roles`, etc.

The connector does not send the following:

- Null or empty string values
- Reserved names used only for output. Names such as `Status`, `message`, or `Attributes`.

The bot can expect the following Automation Anywhere variable types as input:

| Type | Description |
| --- | --- |
| string | String values |
| string | Arrays of strings (serialized as comma-separated or JSON string) |
| number | Numeric values |
| boolean | Boolean values |

The bot receives the same attribute names as in the schema (e.g. `Email`, `accountId`). The identity attribute's name is defined in the connector's account schema.

**Bot Input Example**

```json
{
  "Email":       { "type": "STRING", "string": "john.doe@example.com" },
  "displayName": { "type": "STRING", "string": "John Doe" },
  "Roles":       { "type": "STRING", "string": "[\"Admin\"]" }
}
```

#### Bot Responsibilities

1. **Validate Input** - Check all required fields are present.
2. **Check for Duplicates**

   1. Search the target system for an existing account with same email or username.
   2. If one exists, set `Status = false` and return an error message. For example: "Account with email [john.doe@company.com](<mailto:john.doe@company.com>) already exists"
3. **Create Account**

   - Go to the user creation interface.
   - Fill in all the provided attributes.
   - Submit form / call API.
   - Wait for confirmation.
4. **Assign Initial Entitlements** (if specified)

   - Add the user to their specified roles/groups.
   - Assign default permissions.
5. **Verify Creation**

   - Search for newly created accounts.
   - Confirm that they exist and they are active.
   - If verification fails, set `Status = false`.
6. **Capture Account Details**

   - Scrape all account attributes from the confirmation page or the API response.
   - **Critical**: Capture system-generated fields (account ID, timestamps).
   - **Critical**: Ensure the identity attribute is captured.
7. **Return Output**

   - Set `Status = true` if successful.
   - Include a success message.
   - Include complete account data in the Attributes field.

#### Bot Output Variables

The connector reads the bot's output variables after the bot completes. The bot must return the following output variables in Automation Anywhere's typed variable format.

| Variable | Type | Required | Description |
| --- | --- | --- | --- |
| Status | boolean | Yes | `true` = success.<br><br>`false` = failure.<br><br>If `false`, the connector fails the request and can use a configured `message`. |
| message | string | Recommended | Short reason or detail, especially when `Status` is `false`. |
| Attributes | string | Yes | A JSON string that, when parsed, is an object of account attributes. It must include the identity attribute with the created account's ID.<br><br>**Note:** The identity attribute must be present in the parsed `Attributes` object and must have a non-empty value. The connector uses this to recognize the created account. The exact name is defined in the connector's account schema. |

**Bot Output Example (inline)**

```json
{
  "botOutVariables": {
    "values": {
      "Status":     { "type": "BOOLEAN", "boolean": true },
      "message":    { "type": "STRING",  "string": "Account created" },
      "Attributes": { "type": "STRING",  "string": "{\"Email\":\"john.doe@example.com\",\"displayName\":\"John Doe\",\"Roles\":[\"Admin\"]}" }
    }
  }
}
```

**Bot Output - Success Example**

```json
{
  "botOutVariables": {
    "values": {
      "Status":     { "type": "BOOLEAN", "boolean": true },
      "message":    { "type": "STRING",  "string": "Account john.doe@company.com created successfully in SalesApp" },
      "Attributes": { "type": "STRING",  "string": "{\"email\":\"john.doe@company.com\",\"username\":\"jdoe\",\"firstName\":\"John\",\"lastName\":\"Doe\",\"department\":\"Engineering\",\"jobTitle\":\"Senior Developer\",\"manager\":\"jane.smith@company.com\",\"status\":\"Active\",\"roles\":[\"Developer\",\"User\"],\"accountId\":\"SA-12345\",\"createdDate\":\"2025-01-10T14:30:00Z\",\"lastModifiedDate\":\"2025-01-10T14:30:00Z\"}" }
    }
  }
}
```

**Bot Output - Failure Example (Duplicate)**

```json
{
  "botOutVariables": {
    "values": {
      "Status":     { "type": "BOOLEAN", "boolean": false },
      "message":    { "type": "STRING",  "string": "Cannot create account: Email john.doe@company.com already exists in SalesApp (Account ID: SA-11111)" },
      "Attributes": { "type": "STRING",  "string": "{}" }
    }
  }
}
```

**Bot Output - Failure Example (System Error)**

```json
{
  "botOutVariables": {
    "values": {
      "Status":     { "type": "BOOLEAN", "boolean": false },
      "message":    { "type": "STRING",  "string": "Failed to create account: Target system returned error 'Invalid department code: ENG01'. Please verify department value." },
      "Attributes": { "type": "STRING",  "string": "{}" }
    }
  }
}
```

### UPDATE Operations

When an update account request runs, the connector deploys an Automation Anywhere bot. The bot receives the account identity and the change details (`set` / `add` / `remove`), applies the changes to the target system, and returns a result.

Configure the UPDATE bot file ID in the connector configuration. The bot must be the one associated with that file ID in the Automation Anywhere Control Room.

#### Bot Input Variables

The connector sends typed input variables when deploying the bot via the Automation Anywhere Control Room `/v3/automations/deploy` endpoint. Each variable is sent in Automation Anywhere's typed variable format.

**Variable Format**:

```text
{ "varName": { "type": "STRING", "string": "value" } }
```

The input uses a structured format instead of a flat list of attributes. The update operation groups changes into three categories: `attributesToSet`, `attributesToAdd`, and `attributesToRemove`. These categories are serialized as JSON strings and sent as `STRING`-typed variables.

Top-level variables:

| Variable | Type | Description |
| --- | --- | --- |
| identity attribute | string | The account to modify. The name comes from the connector schema (e.g. `Email`). |
| attributesToSet | string | JSON string of key-value pairs: attributes to **set** (replace). Values can be string, number, boolean, or array of strings. |
| attributesToAdd | string | JSON string of key-value pairs: multi-valued attributes - add these values to the existing list. Values are typically arrays of strings. |
| attributesToRemove | string | JSON string of key-value pairs: multi-valued attributes - remove these values. Values are typically arrays of strings. |
| operation | string | Always **UPDATE** for this bot. |
| timestamp | string | Request timestamp (e.g. for logging). |

> [!NOTE]
>
> Only attributes that exist in the connector's account schema are included. Identity is sent once at the top level; it is not repeated inside the three buckets. Any of the three objects may be empty `{}` if there are no `set`/`add`/`remove` changes for that category.

**Bot Input Example**

```json
{
  "Email":              { "type": "STRING", "string": "user@example.com" },
  "attributesToSet":    { "type": "STRING", "string": "{\"displayName\":\"New Name\"}" },
  "attributesToAdd":    { "type": "STRING", "string": "{}" },
  "attributesToRemove": { "type": "STRING", "string": "{\"Roles\":[\"OldRole\"]}" },
  "operation":          { "type": "STRING", "string": "UPDATE" },
  "timestamp":          { "type": "STRING", "string": "Wed Feb 04 12:00:00 GMT 2026" }
}
```

#### Bot Responsibilities

1. **Locate Account**

   1. Use the identity attribute value to find account in target system.
   2. If an account is not found, set `Status = false` immediately. Example error: `Cannot update: Account john.doe@company.com not found`
2. **Determine What Changed**

   1. Parse the three input JSON strings.
   2. Identify additions, such as new roles using `attributesToAdd`.
   3. Identify removals, such as removed roles using `attributesToRemove`.
   4. Identify modifications, such as department change using `attributesToSet`.
3. **Apply Changes**

   1. Update only the specified attributes.
   2. Do not modify attributes not mentioned in input.
   3. Navigate to edit interface.
   4. Make changes.
   5. Save the changes.
4. **Verify Changes**

   - Re-read account data from target system.
   - Confirm changes applied correctly.
   - If verification fails, consider rolling back the changes.
5. **Capture Updated State**

   - Scrape all current account attributes.
   - **Critical**: Include identity attribute.
   - Include both changed and unchanged attributes (full account state).
6. **Return Output**

   - Set Status = true if all changes applied.
   - Describe what was changed in a message.
   - Include complete account data in the `Attributes` field.

#### Bot Output Variables

The connector reads output variables when the bot finishes execution. The bot must return the following variables in the Automation Anywhere's typed variable format:

| Variable | Type | Required | Description |
| --- | --- | --- | --- |
| Status | boolean | Yes | `true` = success.<br><br>`false` = failure.<br><br>If `false`, the connector fails the request and can use a configured `message`. |
| message | string | Recommended | Short reason or detail, especially when `Status` is `false`. |
| Attributes | string | Yes | A JSON string that parses to an object of account attributes. Must include the identity attribute with the updated account's ID. Other attributes returned here are merged with existing account data so the identity system shows the latest state.<br><br>**Note:** The identity attribute must be present in the parsed `Attributes` object and must have a non-empty value. |

**Bot Output - Success Example**

```json
{
  "botOutVariables": {
    "values": {
      "Status":     { "type": "BOOLEAN", "boolean": true },
      "message":    { "type": "STRING",  "string": "Account updated: Changed department from Engineering to Sales, changed job title to Sales Engineer, added Sales role" },
      "Attributes": { "type": "STRING",  "string": "{\"email\":\"john.doe@company.com\",\"username\":\"jdoe\",\"firstName\":\"John\",\"lastName\":\"Doe\",\"department\":\"Sales\",\"jobTitle\":\"Sales Engineer\",\"manager\":\"bob.jones@company.com\",\"status\":\"Active\",\"roles\":[\"Developer\",\"User\",\"Sales\"],\"lastModifiedDate\":\"2025-01-10T16:15:00Z\"}" }
    }
  }
}
```

**Bot Output - Failure Example (Account Not Found)**

```json
{
  "botOutVariables": {
    "values": {
      "Status":     { "type": "BOOLEAN", "boolean": false },
      "message":    { "type": "STRING",  "string": "Cannot update account: User john.doe@company.com not found in SalesApp. Account may have been deleted." },
      "Attributes": { "type": "STRING",  "string": "{}" }
    }
  }
}
```

### DELETE, ENABLE, and DISABLE Operations

The connector starts an Automation Anywhere bot when a DELETE, ENABLE, or DISABLE account request is run. The bot receives the account identity, then it deletes, activates, or deactivates the account in the target system, and returns a result.

Configure the DELETE, ENABLE, or DISABLE bot file ID in the connector configuration. The bot must be the one associated with that file ID in the Automation Anywhere Control Room.

> [!IMPORTANT]
>
> To use ENABLE or DISABLE account operations, ensure that an attribute named `accountStatus` is included in the data and that it is mapped to set the Account Status (`enabled` or `disabled`) in SailPoint. The attribute `accountStatus` is a boolean attribute where `TRUE` means the account is enabled.

#### Bot Input Variables

The connector sends typed input variables when deploying the bot via the Automation Anywhere Control Room `/v3/automations/deploy` endpoint. Each variable is sent in Automation Anywhere's typed variable format.

**Variable Format:**

```text
{ "varName": { "type": "STRING", "string": "value" } }
```

Top-level fields:

| Variable | Type | Description |
| --- | --- | --- |
| identity attribute | string | The account to modify. The name comes from the connector schema (e.g. Email). This is the only identity field sent. |
| operation | string | DELETE, ENABLE, or DISABLE |
| timestamp | string | Request timestamp (e.g. for logging). |

**Bot Input Example**

DELETE

```json
{
  "Email":    { "type": "STRING", "string": "user@example.com" },
  "operation":{ "type": "STRING", "string": "DELETE" },
  "timestamp":{ "type": "STRING", "string": "Wed Feb 04 12:00:00 GMT 2026" }
}
```

ENABLE

```json
{
  "Email":    { "type": "STRING", "string": "user@example.com" },
  "operation":{ "type": "STRING", "string": "ENABLE" },
  "timestamp":{ "type": "STRING", "string": "Wed Feb 04 12:00:00 GMT 2026" }
}
```

DISABLE

```json
{
  "Email":    { "type": "STRING", "string": "user@example.com" },
  "operation":{ "type": "STRING", "string": "DISABLE" },
  "timestamp":{ "type": "STRING", "string": "Wed Feb 04 12:00:00 GMT 2026" }
}
```

#### Bot Output Variables

Bot output variables are required. The connector requires the bot to complete successfully and to return valid output variables.

If `botOutVariables` is missing, empty, or the `Status` variable is absent, the connector fails the request.

The bot must return the following output variables in Automation Anywhere's typed variable format:

| Variable | Type | Required | Description |
| --- | --- | --- | --- |
| Status | BOOLEAN | Yes | Must be `true` for success. If false, the connector fails the request and uses message as the error reason. |
| message | STRING | Recommended | Short reason for success or failure. Especially important when `Status` is false. |

> [!NOTE]
>
> Attributes are not required. The connector does not read or validate an Attributes variable for DELETE, ENABLE, or DISABLE operations.

**Bot Output Examples**

##### DELETE

Success

```json
{
  "botOutVariables": {
    "values": {
      "Status":  { "type": "BOOLEAN", "boolean": true },
      "message": { "type": "STRING",  "string": "Account deleted" }
    }
  }
}
```

Failure

```json
{
  "botOutVariables": {
    "values": {
      "Status":  { "type": "BOOLEAN", "boolean": false },
      "message": { "type": "STRING",  "string": "Account not found or already removed" }
    }
  }
}
```

##### ENABLE

Success

```json
{
  "botOutVariables": {
    "values": {
      "Status":  { "type": "BOOLEAN", "boolean": true },
      "message": { "type": "STRING",  "string": "Account enabled" }
    }
  }
}
```

Failure

```json
{
  "botOutVariables": {
    "values": {
      "Status":  { "type": "BOOLEAN", "boolean": false },
      "message": { "type": "STRING",  "string": "Account not found or already enabled" }
    }
  }
}
```

##### DISABLE

Success

```json
{
  "botOutVariables": {
    "values": {
      "Status":  { "type": "BOOLEAN", "boolean": true },
      "message": { "type": "STRING",  "string": "Account disabled" }
    }
  }
}
```

Failure

```json
{
  "botOutVariables": {
    "values": {
      "Status":  { "type": "BOOLEAN", "boolean": false },
      "message": { "type": "STRING",  "string": "Account not found or already disabled" }
    }
  }
}
```