# SailPoint Robotic Process Automation Platforms Connector Documentation > Robotic Process Automation Platforms Connector Documentation # Documentation # Automation Anywhere Connection Settings Configure a direct connection to the Automation Anywhere RPA platform. > [!NOTE] > > **Screenshot** > > [![Automation Anywhere connection settings screenshot]()]() 1. Go to **Connection Settings** and in the **RPA Platform** drop-down list, select **Automation Anywhere**. 2. Enter the fully qualified Control Room URL in the **Base URL** field. For example: `https://community.cloud.automationanywhere.digital`. Refer to [Control Room Base URL]() for more information. 3. Enter the valid Control Room username in the **Username** field. 4. Enter the valid Control Room user password in the **Password** field. 5. Select **Save**. # Automation Anywhere Prerequisites This section describes the information you need to collect from the Automation Anywhere Control Room to configure a connection to SailPoint. To configure Automation Anywhere with the RPA connector, you need the following: - Control Room Base URL - Service Account Username and Password - Run As User ID(s) - Device Pool ID(s) (optional) - Bot File IDs (for provisioning operations) ## Control Room Base URL The base URL is the root URL of your Automation Anywhere Control Room instance. To find the base URL: 1. Log in to your Automation Anywhere Control Room. 2. Copy the URL from your browser's address bar. 3. Remove any trailing slashes (/) or path segments from the end of the URL. The base URL must not contain anything after the domain name. **Examples** - **Correct**: `https://community.cloud.automationanywhere.digital` - **Incorrect**: `https://community.cloud.automationanywhere.digital/` (trailing slash) - **Incorrect**: `https://community.cloud.automationanywhere.digital/v2/authentication` (path segment) ## Run As User ID The Run As User is the Automation Anywhere user account that executes the bot. You must configure at least one Run As User ID. To find the User ID, do the following: 1. Log in to your Automation Anywhere Control Room as an administrator. 2. Go to **Administration \> Users**. 3. Select the user that the bot will run as. 4. From your browser's address bar, copy the numeric ID at the end of the URL. - **Example URL**: `.../users/edit/900910` - **User ID**: 900910 > [!IMPORTANT] > > The Run As User must have an active, licensed Bot Runner device assigned in the Control Room. Bot deployment fails if a device is not assigned. ## Device Pool ID (Optional) If your bots execute on a specific device pool, you must configure the **Device Pool ID**. If you leave this parameter empty, the system uses the default device assigned to the **Run As User**. To find the device pool ID, do the following: 1. Log in to your Automation Anywhere Control Room as an administrator. 2. Go to **Administration \> Device Pools**. 3. Select the device pool that the bot will run on. 4. From your browser's address bar, copy the numeric ID at the end of the URL. - Example URL: `.../device-pools/123` - Pool ID: 123 ## Bot File IDs Each provisioning operation (Create, Update, Delete, Enable, Disable) requires a dedicated Automation Anywhere bot. The bot file ID is the numeric identifier for the bot in the Control Room. To find a bot file ID, do the following: 1. Log in to your Automation Anywhere Control Room. 2. Go to **Automation \> My bots** or **Public bots**, depending on where the bot is stored. 3. Select the bot that corresponds to the provisioning operation. 4. From your browser's address bar, copy the numeric ID at the end of the URL. - **Example URL**: `.../bots/edit/112233` - **Bot File ID**: 112233 ### Required Provisioning Operations Configure only the bot file IDs for the operations your deployment requires. For example, if you only use Create and Update operations, only the `CREATE Bot File ID` and `UPDATE Bot File ID` are required. # Automation Anywhere Provisioning Settings This section contains the information used to create, update, enable, disable, and delete accounts by triggering RPA bots. > [!IMPORTANT] > > Upload the bot to the Control Room before configuring its file ID. The connector cannot deploy a bot that exists on a local machine. ## Bot Execution Configuration Configure User IDs and Pool IDs. > [!NOTE] > > **Screenshot** > > [![User ID and Pool ID screenshot]()]() 1. In the **User IDs** field, enter one or more Automation Anywhere user IDs that the bot will run as. For more information, refer to [Run As User ID](). Find these IDs in your Automation Anywhere Control Room under **Administration \> Users**. 2. In the **Pool IDs** field, enter one or more device pool IDs to run the bot on specific devices. For more information, refer to [Device Pool ID (Optional)](). > **Note** > > To use the default device, leave the field empty. 3. Select **Save**. ## Operation Configuration Configure which Automation Anywhere bots to trigger for each provisioning operation. You can find file IDs in the Automation Anywhere Control Room under **Automation \> Bots**. For more information, refer to [Bot File IDs](). > [!NOTE] > > **Screenshot** > > [![Bot IDs screenshot]()]() 1. In the **CREATE Bot File ID** field, enter the bot file ID to trigger when creating new accounts. 2. In the **UPDATE Bot File ID** field, enter the bot file ID to trigger when updating accounts. 3. In the **ENABLE Bot File ID** field, enter the bot file ID to trigger when enabling accounts. 4. In the **DISABLE Bot File ID** field, enter the bot file ID to trigger when disabling accounts. 5. In the **DELETE Bot File ID** field, enter the bot file ID to trigger when deleting accounts. 6. Select **Save**. ## Advanced Polling Settings Configure settings to adjust polling when connecting to the source. This may help resolve timeout errors that occur during provisioning operations. > [!NOTE] > > **Screenshot** > > [![Polling settings screenshot]()]() 1. In the **Max Poll Attempts** field, enter the maximum number of times the connector should check the job status. If the job doesn't complete after the configured number of checks, it times out. 2. In the **Poll Interval in Seconds** field, enter the wait time between job status checks. Increase this value if your workflows take longer to complete. 3. Select **Save**. ## Operation-Specific Guidelines This section provides detailed guidance for provisioning operations in the Automation Anywhere RPA platform. ### Best Practices - **Return a clear result**: Always set `Status` and, on failure, set a `message` so Support can troubleshoot. The response should have the required attributes. - **Always return `botOutVariables`**: The connector requires `botOutVariables` with `Status`. Set `Status: true` on success and `Status: false` on failure. - **Return the created identity**: Always include the identity attribute in `Attributes` with the final value. - **Idempotency**: If the same operation is retried, consider designing the target system or workflow so it does not create duplicates (e.g. "create if not exists" or use a stable identifier). - **Errors**: On failure, set `Status: false` and put a short, user-friendly reason in `message`; avoid exposing sensitive details. - **Logging**: Log input and outcome (success or failure) in Automation Anywhere for auditing and support; avoid logging secrets in plain text. - **Atomic Operations** - If the create operation partially fails, for example if the account is created but role assignment fails: - **Option A**: Rollback the partially created account then set `Status = false`. - **Option B**: Complete what's possible, then set `Status = true`. Note the issue in a message. > **Note** > > SailPoint recommends that you roll back for consistency. - **Apply set / add / remove correctly**: In the target system, implement `Set` as "replace value", `Add` as "append to list", `Remove` as "remove these values from list" so the behavior matches the connector's intent. - **Return current state**: Prefer returning the updated account's attributes in `Attributes` (at least identity + any attributes your workflow changes) so the connector can merge and show up-to-date data. ### CREATE Operations When the connector receives a Create Account request, it deploys a dedicated Automation Anywhere bot. The bot receives input, performs the account creation in the target system, and returns the result to the connector. Configure the CREATE bot file ID in the connector configuration. The bot must be the one associated with that file ID in the Automation Anywhere Control Room. #### Bot Input Variables The connector sends input variables to the bot using the Automation Anywhere `/v3/automations/deploy` endpoint. Each variable is formatted as an Automation Anywhere typed variable. **Variable Format**: ```text { "varName": { "type": "STRING", "string": "value" } } ``` The input contains one typed variable per attribute from the provisioning request. Names and sets of attributes depend on the account schema and what the request contains. For example, `Email`, `displayName`, `Roles`, etc. The connector does not send the following: - Null or empty string values - Reserved names used only for output. Names such as `Status`, `message`, or `Attributes`. The bot can expect the following Automation Anywhere variable types as input: | Type | Description | | --- | --- | | string | String values | | string | Arrays of strings (serialized as comma-separated or JSON string) | | number | Numeric values | | boolean | Boolean values | The bot receives the same attribute names as in the schema (e.g. `Email`, `accountId`). The identity attribute's name is defined in the connector's account schema. **Bot Input Example** ```json { "Email": { "type": "STRING", "string": "john.doe@example.com" }, "displayName": { "type": "STRING", "string": "John Doe" }, "Roles": { "type": "STRING", "string": "[\"Admin\"]" } } ``` #### Bot Responsibilities 1. **Validate Input** - Check all required fields are present. 2. **Check for Duplicates** 1. Search the target system for an existing account with same email or username. 2. If one exists, set `Status = false` and return an error message. For example: "Account with email [john.doe@company.com]() already exists" 3. **Create Account** - Go to the user creation interface. - Fill in all the provided attributes. - Submit form / call API. - Wait for confirmation. 4. **Assign Initial Entitlements** (if specified) - Add the user to their specified roles/groups. - Assign default permissions. 5. **Verify Creation** - Search for newly created accounts. - Confirm that they exist and they are active. - If verification fails, set `Status = false`. 6. **Capture Account Details** - Scrape all account attributes from the confirmation page or the API response. - **Critical**: Capture system-generated fields (account ID, timestamps). - **Critical**: Ensure the identity attribute is captured. 7. **Return Output** - Set `Status = true` if successful. - Include a success message. - Include complete account data in the Attributes field. #### Bot Output Variables The connector reads the bot's output variables after the bot completes. The bot must return the following output variables in Automation Anywhere's typed variable format. | Variable | Type | Required | Description | | --- | --- | --- | --- | | Status | boolean | Yes | `true` = success.

`false` = failure.

If `false`, the connector fails the request and can use a configured `message`. | | message | string | Recommended | Short reason or detail, especially when `Status` is `false`. | | Attributes | string | Yes | A JSON string that, when parsed, is an object of account attributes. It must include the identity attribute with the created account's ID.

**Note:** The identity attribute must be present in the parsed `Attributes` object and must have a non-empty value. The connector uses this to recognize the created account. The exact name is defined in the connector's account schema. | **Bot Output Example (inline)** ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": true }, "message": { "type": "STRING", "string": "Account created" }, "Attributes": { "type": "STRING", "string": "{\"Email\":\"john.doe@example.com\",\"displayName\":\"John Doe\",\"Roles\":[\"Admin\"]}" } } } } ``` **Bot Output - Success Example** ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": true }, "message": { "type": "STRING", "string": "Account john.doe@company.com created successfully in SalesApp" }, "Attributes": { "type": "STRING", "string": "{\"email\":\"john.doe@company.com\",\"username\":\"jdoe\",\"firstName\":\"John\",\"lastName\":\"Doe\",\"department\":\"Engineering\",\"jobTitle\":\"Senior Developer\",\"manager\":\"jane.smith@company.com\",\"status\":\"Active\",\"roles\":[\"Developer\",\"User\"],\"accountId\":\"SA-12345\",\"createdDate\":\"2025-01-10T14:30:00Z\",\"lastModifiedDate\":\"2025-01-10T14:30:00Z\"}" } } } } ``` **Bot Output - Failure Example (Duplicate)** ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": false }, "message": { "type": "STRING", "string": "Cannot create account: Email john.doe@company.com already exists in SalesApp (Account ID: SA-11111)" }, "Attributes": { "type": "STRING", "string": "{}" } } } } ``` **Bot Output - Failure Example (System Error)** ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": false }, "message": { "type": "STRING", "string": "Failed to create account: Target system returned error 'Invalid department code: ENG01'. Please verify department value." }, "Attributes": { "type": "STRING", "string": "{}" } } } } ``` ### UPDATE Operations When an update account request runs, the connector deploys an Automation Anywhere bot. The bot receives the account identity and the change details (`set` / `add` / `remove`), applies the changes to the target system, and returns a result. Configure the UPDATE bot file ID in the connector configuration. The bot must be the one associated with that file ID in the Automation Anywhere Control Room. #### Bot Input Variables The connector sends typed input variables when deploying the bot via the Automation Anywhere Control Room `/v3/automations/deploy` endpoint. Each variable is sent in Automation Anywhere's typed variable format. **Variable Format**: ```text { "varName": { "type": "STRING", "string": "value" } } ``` The input uses a structured format instead of a flat list of attributes. The update operation groups changes into three categories: `attributesToSet`, `attributesToAdd`, and `attributesToRemove`. These categories are serialized as JSON strings and sent as `STRING`-typed variables. Top-level variables: | Variable | Type | Description | | --- | --- | --- | | identity attribute | string | The account to modify. The name comes from the connector schema (e.g. `Email`). | | attributesToSet | string | JSON string of key-value pairs: attributes to **set** (replace). Values can be string, number, boolean, or array of strings. | | attributesToAdd | string | JSON string of key-value pairs: multi-valued attributes - add these values to the existing list. Values are typically arrays of strings. | | attributesToRemove | string | JSON string of key-value pairs: multi-valued attributes - remove these values. Values are typically arrays of strings. | | operation | string | Always **UPDATE** for this bot. | | timestamp | string | Request timestamp (e.g. for logging). | > [!NOTE] > > Only attributes that exist in the connector's account schema are included. Identity is sent once at the top level; it is not repeated inside the three buckets. Any of the three objects may be empty `{}` if there are no `set`/`add`/`remove` changes for that category. **Bot Input Example** ```json { "Email": { "type": "STRING", "string": "user@example.com" }, "attributesToSet": { "type": "STRING", "string": "{\"displayName\":\"New Name\"}" }, "attributesToAdd": { "type": "STRING", "string": "{}" }, "attributesToRemove": { "type": "STRING", "string": "{\"Roles\":[\"OldRole\"]}" }, "operation": { "type": "STRING", "string": "UPDATE" }, "timestamp": { "type": "STRING", "string": "Wed Feb 04 12:00:00 GMT 2026" } } ``` #### Bot Responsibilities 1. **Locate Account** 1. Use the identity attribute value to find account in target system. 2. If an account is not found, set `Status = false` immediately. Example error: `Cannot update: Account john.doe@company.com not found` 2. **Determine What Changed** 1. Parse the three input JSON strings. 2. Identify additions, such as new roles using `attributesToAdd`. 3. Identify removals, such as removed roles using `attributesToRemove`. 4. Identify modifications, such as department change using `attributesToSet`. 3. **Apply Changes** 1. Update only the specified attributes. 2. Do not modify attributes not mentioned in input. 3. Navigate to edit interface. 4. Make changes. 5. Save the changes. 4. **Verify Changes** - Re-read account data from target system. - Confirm changes applied correctly. - If verification fails, consider rolling back the changes. 5. **Capture Updated State** - Scrape all current account attributes. - **Critical**: Include identity attribute. - Include both changed and unchanged attributes (full account state). 6. **Return Output** - Set Status = true if all changes applied. - Describe what was changed in a message. - Include complete account data in the `Attributes` field. #### Bot Output Variables The connector reads output variables when the bot finishes execution. The bot must return the following variables in the Automation Anywhere's typed variable format: | Variable | Type | Required | Description | | --- | --- | --- | --- | | Status | boolean | Yes | `true` = success.

`false` = failure.

If `false`, the connector fails the request and can use a configured `message`. | | message | string | Recommended | Short reason or detail, especially when `Status` is `false`. | | Attributes | string | Yes | A JSON string that parses to an object of account attributes. Must include the identity attribute with the updated account's ID. Other attributes returned here are merged with existing account data so the identity system shows the latest state.

**Note:** The identity attribute must be present in the parsed `Attributes` object and must have a non-empty value. | **Bot Output - Success Example** ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": true }, "message": { "type": "STRING", "string": "Account updated: Changed department from Engineering to Sales, changed job title to Sales Engineer, added Sales role" }, "Attributes": { "type": "STRING", "string": "{\"email\":\"john.doe@company.com\",\"username\":\"jdoe\",\"firstName\":\"John\",\"lastName\":\"Doe\",\"department\":\"Sales\",\"jobTitle\":\"Sales Engineer\",\"manager\":\"bob.jones@company.com\",\"status\":\"Active\",\"roles\":[\"Developer\",\"User\",\"Sales\"],\"lastModifiedDate\":\"2025-01-10T16:15:00Z\"}" } } } } ``` **Bot Output - Failure Example (Account Not Found)** ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": false }, "message": { "type": "STRING", "string": "Cannot update account: User john.doe@company.com not found in SalesApp. Account may have been deleted." }, "Attributes": { "type": "STRING", "string": "{}" } } } } ``` ### DELETE, ENABLE, and DISABLE Operations The connector starts an Automation Anywhere bot when a DELETE, ENABLE, or DISABLE account request is run. The bot receives the account identity, then it deletes, activates, or deactivates the account in the target system, and returns a result. Configure the DELETE, ENABLE, or DISABLE bot file ID in the connector configuration. The bot must be the one associated with that file ID in the Automation Anywhere Control Room. > [!IMPORTANT] > > To use ENABLE or DISABLE account operations, ensure that an attribute named `accountStatus` is included in the data and that it is mapped to set the Account Status (`enabled` or `disabled`) in SailPoint. The attribute `accountStatus` is a boolean attribute where `TRUE` means the account is enabled. #### Bot Input Variables The connector sends typed input variables when deploying the bot via the Automation Anywhere Control Room `/v3/automations/deploy` endpoint. Each variable is sent in Automation Anywhere's typed variable format. **Variable Format:** ```text { "varName": { "type": "STRING", "string": "value" } } ``` Top-level fields: | Variable | Type | Description | | --- | --- | --- | | identity attribute | string | The account to modify. The name comes from the connector schema (e.g. Email). This is the only identity field sent. | | operation | string | DELETE, ENABLE, or DISABLE | | timestamp | string | Request timestamp (e.g. for logging). | **Bot Input Example** DELETE ```json { "Email": { "type": "STRING", "string": "user@example.com" }, "operation":{ "type": "STRING", "string": "DELETE" }, "timestamp":{ "type": "STRING", "string": "Wed Feb 04 12:00:00 GMT 2026" } } ``` ENABLE ```json { "Email": { "type": "STRING", "string": "user@example.com" }, "operation":{ "type": "STRING", "string": "ENABLE" }, "timestamp":{ "type": "STRING", "string": "Wed Feb 04 12:00:00 GMT 2026" } } ``` DISABLE ```json { "Email": { "type": "STRING", "string": "user@example.com" }, "operation":{ "type": "STRING", "string": "DISABLE" }, "timestamp":{ "type": "STRING", "string": "Wed Feb 04 12:00:00 GMT 2026" } } ``` #### Bot Output Variables Bot output variables are required. The connector requires the bot to complete successfully and to return valid output variables. If `botOutVariables` is missing, empty, or the `Status` variable is absent, the connector fails the request. The bot must return the following output variables in Automation Anywhere's typed variable format: | Variable | Type | Required | Description | | --- | --- | --- | --- | | Status | BOOLEAN | Yes | Must be `true` for success. If false, the connector fails the request and uses message as the error reason. | | message | STRING | Recommended | Short reason for success or failure. Especially important when `Status` is false. | > [!NOTE] > > Attributes are not required. The connector does not read or validate an Attributes variable for DELETE, ENABLE, or DISABLE operations. **Bot Output Examples** ##### DELETE Success ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": true }, "message": { "type": "STRING", "string": "Account deleted" } } } } ``` Failure ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": false }, "message": { "type": "STRING", "string": "Account not found or already removed" } } } } ``` ##### ENABLE Success ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": true }, "message": { "type": "STRING", "string": "Account enabled" } } } } ``` Failure ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": false }, "message": { "type": "STRING", "string": "Account not found or already enabled" } } } } ``` ##### DISABLE Success ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": true }, "message": { "type": "STRING", "string": "Account disabled" } } } } ``` Failure ```json { "botOutVariables": { "values": { "Status": { "type": "BOOLEAN", "boolean": false }, "message": { "type": "STRING", "string": "Account not found or already disabled" } } } } ``` # Automation Anywhere Troubleshooting If you encounter any of the following issues or errors while configuring the Automation Anywhere RPA platform, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Connection test failed: Unknown host **Cause**: Base URL is incorrect or network cannot resolve hostname **Resolution**: 1. Verify the base URL format. 2. Check for typos in the hostname. 3. Confirm the Automation Anywhere Control Room tenant is active (not suspended). ## Authentication failed: token missing from response **Cause**: Automation Anywhere username or password is incorrect or the account is locked **Resolution**: 1. Verify the Automation Anywhere username and password configured in SailPoint: 1. Go to Automation Anywhere **Control Room \> Administration \> Users**. 2. Confirm the user account exists and is active. 3. Reset the password if needed and update the connector configuration. 2. Confirm the user account is not locked or disabled in Automation Anywhere Control Room. 3. Ensure the Automation Anywhere Control Room URL (`Base URL`) points to the correct tenant. 4. Verify that the user has API access enabled in Automation Anywhere Control Room. ## Automation Anywhere token validation failed: token is not valid **Cause**: The token obtained during authentication failed the validation step **Resolution**: 1. Verify the Automation Anywhere Control Room URL is correct and reachable. 2. Confirm the Automation Anywhere user account has not been deactivated between authentication and validation. 3. Check that the Automation Anywhere Control Room version supports the `/v1/authentication/token` validation endpoint. 4. Try re-running Test Connection; a transient Control Room issue may cause intermittent token validation failures. ## Connection test failed: 401 Unauthorized **Cause**: Automation Anywhere credentials are invalid or the user account lacks API access **Resolution**: 1. Verify the Automation Anywhere username and password in the connector configuration. 2. Confirm the user account exists and is not locked in Automation Anywhere Control Room: 1. Go to Automation Anywhere **Control Room** \> **Administration** \> **Users**. 2. Check the account status. 3. Ensure the user has the **AAE\_Basic** role or equivalent that allows API authentication. 4. Verify that the Automation Anywhere Control Room URL (`Base URL`) is correct and does not include a trailing slash. ## Bot file ID not configured; required for operation **Cause**: The bot file ID for the requested operation is missing from the connector configuration **Resolution**: 1. Verify that the bot file ID is configured in SailPoint for the required operation: 1. Create `FileId` 2. Update `FileId` 3. Delete `FileId` 4. Enable `FileId` 5. Disable `FileId` 2. To find the correct file ID in Automation Anywhere Control Room: 1. Log into Automation Anywhere Control Room. 2. Go to **Automation \> Bots**. 3. Find your bot. 4. The file ID is the numeric ID shown in the bot details or in the URL. 5. Copy the numeric ID and paste it into the SailPoint configuration. 3. Ensure the bot is uploaded and available in Automation Anywhere Control Room (not just locally saved). 4. Verify that the Run As User (`aaRunAsUserIds`) has permission to run the bot. ## Bot execution FAILED or Bot execution STOPPED **Cause**: The Automation Anywhere bot encountered an error during execution or was manually stopped **Resolution**: 1. Log into Automation Anywhere Control Room and check the activity logs: 1. Go to **Activity \> Historical**. 2. Find the failed or stopped activity. 3. Review the error details and bot execution logs. 2. Common causes: 1. Target system is unavailable or credentials used by the bot have expired. 2. Bot logic encountered an unexpected UI or API response in the target system. 3. Bot was manually stopped by a Control Room administrator. 3. Verify that the Run As User device or bot runner is online and available. 4. If using device pools (`poolIds`), confirm at least one device in the pool is active. 5. Re-run the provisioning request after resolving the underlying bot error. ## Bot output Status is false **Cause**: The bot completed successfully in Automation Anywhere Control Room but the operation failed in the target system **Resolution**: 1. Check the `message` output variable returned by the bot for details about the failure. 2. Common causes: 1. Account not found in target system (for UPDATE, DELETE, ENABLE, DISABLE). 2. Duplicate account detected (for CREATE). 3. Target system returned a validation error, like invalid attribute value 3. Review the bot execution logs in Automation Anywhere Control Room for more detail: 1. Go to **Activity \> Historical**. 2. Find the completed activity. 3. Check bot log output for the specific error. 4. Correct the underlying data issue and re-run the provisioning request. ## aaRunAsUserIds is required but not configured **Cause**: No Run As User ID is configured in the connector provisioning settings **Resolution**: 1. Configure at least one Run As User ID in the connector configuration (`aaRunAsUserIds`). 2. To find the Run As User ID in Automation Anywhere Control Room: 1. Go to **Administration \> Users**. 2. Find the user that the bot should run as. 3. The user ID is the numeric ID shown in the user details or in the URL. 4. Copy the numeric ID and paste it into the SailPoint configuration. 3. Verify that the Run As User has an active device or is assigned to a device pool. 4. Ensure the Run As User has permission to execute the configured bots. # Configuring a Connection to Automation Anywhere Connect and configure the Robotic Process Automation connector to interact with the Automation Anywhere RPA platform. - [Automation Anywhere Prerequisites]() - [Automation Anywhere Connection Settings]() - [Automation Anywhere Provisioning Settings]() - [Automation Anywhere Troubleshooting]() # Connecting SailPoint and Robotic Process Automation Platforms To connect SailPoint with Robotic Process Automation Platforms, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 9. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 10. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 7. Select **Save**. ## Connection Settings Configure a direct, secured connection to the RPA platform. This connection is required to support API-based aggregation and provisioning operations. Every RPA platform is unique, so the steps required to establish and secure this connection may vary. Select the link below for specific instructions to connect to your RPA platform. - [UiPath Connection Settings]() - [Automation Anywhere Connection Settings]() ## Aggregation Settings Configure how the connector aggregates data from the data source. The RPA connector can aggregate account and entitlement data from the data source using an SFTP connection or through certain RPA platforms via an API. > [!NOTE] > > Aggregation using an SFTP configuration does not require you to configure additional settings unique to a specific RPA platform. ### Aggregation Method Select how to fetch account data. > [!NOTE] > > **Screenshot** > > [![Aggregation settings screenshot]()]() ### API Configuration Configuring aggregation via an RPA platform and an API varies depending on the RPA platform being used. SailPoint supports API-based aggregation in the RPA platforms listed below. Select the link below for specific instructions to configure aggregation to your RPA platform. - [UiPath Aggregation Settings]() ### SFTP Configuration Set up an SFTP configuration to support aggregation using a CSV file. > [!NOTE] > > **Screenshot** > > [![SFTP server configuration screenshot]()]() 1. Enter the **Host URL** for the SFTP server. SailPoint recommends using HTTPS for a secured connection. 2. Enter the **Port** for the SFTP server. The default is 22. 3. Enter the **Username** and **Password** to authenticate with the SFTP server. 4. Enter the **Account CSV File Path** and the **Entitlement CSV File Path** relative to the SFTP server's root directory. For example, `/upload/files/account_list.csv`. The CSV file must be less than 4 GB. This is required for the connector to locate account and entitlement data for aggregation. > **Important** > > The file must be UTF-8 encoded. Be sure the specified directory exists and is accessible to the SFTP user. 5. Configure the **Connection Timeout in Seconds**. The default is 30 seconds. 6. Select **Save**. ## Provisioning Settings Provisioning uses your RPA platform to create, update, delete, enable, or disable accounts, as well as add or remove entitlements. To support each operation, you must configure release keys (or an appropriate equivalent) for each operation and set the account identity attribute. Optionally, you can adjust job polling. Select the link below for specific instructions to configure provisioning operations for your RPA platform. - [UiPath Provisioning Settings]() - [Automation Anywhere Provisioning Settings]() ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Integrating SailPoint with Robotic Process Automation Platforms The SailPoint Robotic Process Automation (RPA) connector provides a solution for managing identities in applications that lack modern APIs or have limited integration capabilities. By leveraging Robotic Process Automation (RPA) platforms, you can automate identity lifecycle management for: - Legacy mainframe systems - Applications with web-only interfaces - Homegrown business applications - Vendor systems without API support - On-premise applications requiring UI automation ## High Level Architecture This architecture diagram illustrates the core components of the Robotic Process Automation connector. [![RPA connector architecture diagram]()]() 1. SailPoint uses the RPA connector to request identity data for aggregation or request changes for provisioning. 2. The RPA connector communicates to the RPA platform (e.g., UiPath) to run jobs or read data. 3. The RPA platform runs bots/processes that connect to the disconnected applications. In doing so, it collects or updates the identity-related data from the disconnected applications as requested. 4. Finally, the data or status flows back: **Disconnected application \> RPA Platform \> RPA Connector \> SailPoint**. ## Supported Features The connector supports the features listed on this page. ### Test Connection Test connections between SailPoint and the RPA platform before putting it into production. ### Account Aggregation Retrieve user account data from disconnected applications. - API-based data collection - File-based data collection ### Entitlement Aggregation Retrieve entitlement data from disconnected applications. - API-based data collection - File-based data collection ### Account Provisioning Execute account lifecycle operations by triggering RPA workflows particular to triggered operations. The connector supports the following operations: - Create Account - Update Account - Delete Account - Enable/Disable Account - Add/Remove Entitlement ## Supported RPA Platforms The SailPoint Robotic Process Automation connector can connect SailPoint to the following RPA platforms: - UiPath (Cloud) - Automation Anywhere (Cloud) ## Required Permissions Configure the permissions required to grant necessary access rights to resources or data within the system to perform all RPA connector operations. Select the link below for your specific RPA platform. - [UiPath Prerequisites]() - [Automation Anywhere Prerequisites]() # Schema Reference The RPA connector does not include account schemas by default. The schema is not specific to a given RPA platform. If available, SailPoint can discover attributes in the data source and use that to generate an account schema. Alternatively, you can manually create the schema in SailPoint. ## Schema Discovery The connector automatically detects account attributes from your data source and suggests an account schema. > [!NOTE] > > The connector does not support entitlement schema discovery. Entitlement schemas must be manually created. The schema process is generally as follows: 1. The connector reads sample records from the data source. 2. It analyzes attribute names and data types. 3. It suggests identity and display attributes. 4. Finally, it presents the schema for your review and approval. To discover attributes and generate a schema: 1. In SailPoint, go to your RPA source. Go to **Schema** and select **Discover Schema**. 2. Review the Discovered Schema: 1. Check the attribute names. 2. Verify the data types. 3. Adjust as needed. 3. From the list of attributes, set an **Identity Attribute**. It should be a unique identifier such as `email`. 4. Set the display attribute. It should be a human-readable name such as `displayName`. 5. Select which attributes that can be provisioned by selecting the **Managed** checkbox in each attribute listing. 6. Define the entitlement attributes by selecting the **Entitlement** checkbox in each attribute listing. 7. Select **Save**. ## Manual Schema Creation If the schema discovery fails or returns incorrect results, or if you require precise control over attribute descriptions, you can manually create the account schema. > [!IMPORTANT] > > While manually creating a schema, be sure that the attributes you add match the attributes in the data source exactly. To create a schema manually: 1. In SailPoint, go to your RPA source. Go to the **Schema** tab and select **\+ Add Attribute**. 2. Create each attribute. Consider the following as you create each one: 1. **Attribute Name**: This is the technical name; it must match data source exactly. 2. **Display Name**: User-friendly name shown in the user interface. 3. **Description**: Optional but recommended for documentation. 4. **Type**: Select **STRING**, **INT**, or **BOOLEAN** depending on what kind of information the attribute will describe. 5. Mark as **Multi-Valued**: Indicates if the attribute will contain multiple values, such as a list of groups in which the account is included. 6. Mark as an **Entitlement**: Indicates if the attribute describes groups, roles or permissions. 7. Mark the attribute as **Managed** if the attribute is able to be included in provisioning operations. 3. Repeat until you've created all attributes. 4. From the list of attributes, set an **Identity Attribute**. It should be a unique identifier such as `email`. 5. Set the display attribute. It should be a human-readable name such as `displayName`. 6. Select **Save**. # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Issue: "SFTP connection failed: Authentication failed" **Cause**: Incorrect SFTP username or password **Resolution**: 1. Verify SFTP credentials: 1. Test the login with an SFTP client such as FileZilla or WinSCP. 2. Confirm the username is correct (case-sensitive). 3. Verify that the password is correct (no extra spaces, special characters). 2. Check if the SFTP account is locked or disabled. 3. Verify that the SFTP server allows password authentication (not just keys). 4. Confirm that the service account has SFTP access (not just local login). ## Issue: "SFTP connection timeout" **Cause**: Network blocking, firewall, or incorrect host or port **Resolution**: 1. Verify SFTP host and port: - The default SFTP port is 22. - Confirm that your server uses a standard or custom port. 2. Test connectivity: `telnet`. 3. Check firewall rules allow outbound SSH (port 22). Increase the `sftpTimeout` value. The default is 30000ms; try increasing it to 60000ms. 4. Verify that the SFTP server is running and accessible. ## Issue: "Identity attribute missing from response" **Cause**: Column name mismatch between data source and schema **Resolution**: 1. Verify that the identity attribute is in the schema. 2. Check that the data source column name matches the schema header exactly. 3. Verify the column contains data (not all null). ## Issue: "Column names do not match schema" **Cause**: Attribute names in the data source don't match their schema definitions **Resolution**: 1. Compare schema attributes to data source columns: 1. Export the schema attributes to a list. 2. Export the data source columns to a list. 3. Find any differences and correct them. 2. Common mismatches: - Case: `firstName` vs `FirstName` - Spaces: `jobTitle` vs `Job Title` - Underscores: `first_name` vs `firstName` 3. Do one of the following: - Rename data source columns (recommended) - Update schema attributes (if acceptable) ## Issue: "CSV file not found" **Cause**: Incorrect file path or the file doesn't exist **Resolution**: 1. Verify that the file path is absolute (from SFTP root): - Incorrect - `accounts.csv` (relative) - Incorrect - `~/accounts.csv` (tilde not supported) - Correct - `/sailpoint/data/accounts.csv` (absolute) 2. Test the path in the SFTP client: - Connect with the SFTP client. - Go to the specified path. - Confirm that the file exists. 2. Check file permissions. The SFTP user must have read access. 3. Verify that the file was uploaded by the RPA workflow before aggregation. ## Issue: "CSV parsing error: Values count doesn't match headers count" **Cause**: CSV file has malformed rows (mismatched column count) **Resolution**: 1. Validate the CSV format: 1. Open in Excel or another text editor. 2. Check that each row has the same number of columns. 3. Look for missing commas or extra commas. 2. Check for unescaped commas in values: - Incorrect - `john@company.com,John Doe, Jr.,Engineering` (comma in name not quoted) - Correct - `john@company.com,"John Doe, Jr.",Engineering` (comma in quotes) 3. Verify line endings (Unix LF vs Windows CRLF) - usually auto-detected. 4. Check for empty rows (remove trailing new lines). ## Issue: "Job polling timeout: Job did not complete within expected time" **Cause**: Workflow takes longer than what polling timeout allows **Resolution**: 1. Calculate current timeout. - Formula: `maxPollAttempts` × `pollIntervalSeconds` - Example: 20 × 30 = 600 seconds (10 minutes) 2. Check the average workflow execution time in the RPA platform: 1. View job history in Orchestrator. 2. Find the average duration. 3. Adjust polling settings: - If workflows average eight minutes, but timeout is 10 minutes, increase to 15-20 minutes. - Increase `maxPollAttempts` to 30-40, or increase `pollIntervalSeconds` to 45-60. 4. Optimize workflow: - Reduce unnecessary waits. - Optimize selectors. - Parallelize steps where possible. ## Issue: "Job execution failed: Status field is missing from OutputArguments" **Cause**: Workflow does not return the required output structure **Resolution**: Check `OutputArguments` in the job details. Verify that the format matches the expected structure. ## Issue: "Job succeeded but operation failed: `[error message]`" **Cause**: Workflow returned `Status = false`, indicating that the operation failed in target system **Resolution**: 1. Check the error message in the SailPoint provisioning history. 2. Review the job logs for detailed error information. 3. Common causes: - Account already exists (CREATE) - Account not found (UPDATE/DELETE) - Invalid attribute value - Insufficient permissions in target system - Target system validation error 4. Verify that the input data is valid: 1. Check attribute values make sense. 2. Confirm required fields are present. 3. Validate format (email, phone, etc.). 5. Test the workflow manually in target system to test if the UI automation is failing. ## Issue: "Identity attribute missing from job output" **Cause**: Workflow didn't return the identity attribute in the `Attributes` field **Resolution**: 1. Identify your identity attribute. 2. Check that the workflow's `Attributes` output includes this field: ```json { "Status": true, "message": "Success", "Attributes": "{\"email\":\"john@company.com\", ...}" ↑ Must be present } ``` 3. Update the workflow to always capture the identity attribute: - For CREATE: Scrape the generated ID after creation. - For UPDATE: Include the identity attribute from the input. - For DELETE: Include the identity attribute from the input. 4. Validate before returning: ```text If Not attributes.ContainsKey("email") Then Throw New Exception("Identity attribute missing") End If ``` ## Issue: "Failed to parse job response: Invalid JSON" **Cause**: The `OutputArguments` value is not in a valid JSON format **Resolution**: 1. Check `OutputArguments` in job details: 1. Is it empty? (missing assignment) 2. Is it malformed JSON? (syntax error) 2. Common JSON errors: 1. Missing quotes: - Incorrect - `{Status: true}` - Correct - `{"Status": true}` 2. Trailing comma: - Incorrect - `{"Status": true,}` - Correct - `{"Status": true}` 3. Single quotes: - Incorrect - `{'Status': true}` - Correct - `{"Status": true}` 4. Unescaped quotes in strings: - Incorrect - `{"message": "User "John" created"}` 3. Use the JSON serialization library; don't build JSON strings manually. ```text Correct (uses serialization) out_OutputArguments = JsonConvert.SerializeObject(outputDict) Incorrect (manual string building) out_OutputArguments = "{""Status"": true}" ``` 4. Test JSON validity: 1. Copy the `OutputArguments` value. 2. Paste it into an online JSON validator. 3. Fix any syntax errors the validator finds. ## Issue: "Provisioning Timeout" **Cause**: Provisioning operations fail because operations take longer than the connector expects **Resolution**: Configure the `provisioningTimeout` attribute to help compensate for longer duration provisioning operations. For example, if your current time value is 180 seconds and you experience provisioning timeout errors, update the `provisioningTimeout` attribute as follows, thereby doubling the allowed provisioning operation duration: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` # Configuring a Connection to UiPath Connect and configure the Robotic Process Automation connector to interact with the UiPath RPA platform. - [UiPath Prerequisites]() - [UiPath Connection Settings]() - [UiPath Aggregation Settings]() - [UiPath Provisioning Settings]() - [UiPath Troubleshooting]() # UiPath Aggregation Settings Configure settings related to aggregation processes. ## Before You Begin Consider the following important points before you configure and run aggregation processes. - SailPoint fetches data directly from the data source (Data Fabric or the CSV file). - Before running an aggregation process, be sure that the data in the data source is up to date. - Ensure that the data source contains all the attributes you want to aggregate. - Ensure that the schema defined in SailPoint matches the schema in the data source exactly. ## Configure API-Based Aggregation Enter the information needed to aggregate account data from Data Fabric. > [!NOTE] > > **Screenshot** > > [![API aggregation method screenshot]()]() 1. In the **Account Entity ID** field, enter the unique identifier for the Data Fabric entity which stores user data. 2. In the **Entitlement Entity ID** field, enter the unique identifier for the Data Fabric entity which stores entitlement data. 3. Select **Save**. ### Data Refresh Strategy Your RPA workflows must keep Data Fabric updated: - **Full Refresh**: Workflow runs daily, replaces all entity records. - **Incremental Update**: Workflow detects changes, updates only modified records. ## Configure SFTP-Based Aggregation Configure the connector to perform aggregation with a CSV file. For instructions on how to configure SFTP-based aggregation, refer to [SFTP Configuration](). # UiPath Connection Settings Configure a direct connection to the UiPath RPA platform. > [!NOTE] > > **Screenshot** > > [![UiPath connection settings screenshot]()]() 1. Go to **Connection Settings** and in the **RPA Platform** drop-down list, select **UiPath**. 2. Enter the fully qualified **Base URL** (without service paths) to the UiPath tenant. For example: `https://cloud.uipath.com/{your-tenant-name}` For more information, refer to [Identifying Your Base URL](). > **Important** > > There is no need to append `/orchestrator_` or `/dataservice_` to the Base URL; the connector adds these automatically as needed. Also, be sure to remove any trailing slashes. 3. Enter the authentication credential for API access used to authenticate for aggregation and provisioning in the **API Token** field. For more information, refer to [API Token](). > **Note** > > SailPoint encrypts this data. 4. Select **Save**. # UiPath Prerequisites This section describes the information you need to collect from the UiPath RPA platform to configure a connection to SailPoint. To configure UiPath with the RPA connector, you should have access to the following: - UIPath Orchestrator (Cloud) - UiPath Data Fabric (only if using API based Aggregation) - API Token Generation and Management Access ## Identifying Your Base URL The Base URL is the root address of your UiPath tenant, required for connector configuration. The format is as follows: ```text https://cloud.uipath.com/{organization-name}/{tenant-name} ``` To find your Base URL: 1. Log into UiPath Cloud or Orchestrator. 2. Copy the URL in your web browser up to, but not including `/orchestrator_` or any other service paths. For example: ```text https://cloud.uipath.com/mycompany/defaulttenant ``` ## Folder / Organization Unit Structure UiPath organizes processes into folders. These are also called Organization Units. Your processes and workflows are deployed to a specific folder. You need the Organization Unit ID to configure provisioning. The default folder is typically named "Default" or your tenant name. To find your folder name: 1. Go to **Folders** in Orchestrator. 2. Note the folder name where your integration workflows will run. Note this for configuration in SailPoint. ## Organization Unit ID The Organization Unit ID is required to configure provisioning. It is found in the URL when you view a folder. The format is a long numeric ID number. For example, if your URL ends with `.../?tid=789&fid=123456` the Organization Unit ID is `123456`. ## API Token SailPoint recommends that you use a Personal Access Token for this configuration. The token should have the following: - **Token Name** - For example, `SailPoint Integration`. Use a descriptive name to identify the token's purpose. - Set an **Expiration Date** to either be long term or one that will not expire. - Select **Orchestrator API Access** in the Resource dropdown. - **Scopes**: Select the following permissions (if available): - **OR.Users.Read** - View - **OR.Jobs** - View and execute jobs - **OR.Execution** - Execute processes - **OR.Folders** - View folder information - Select **Data Fabric API** in the Resource dropdown. - **Scopes**: Select the following permissions (if available): - **DataFabric.Data.Read** - Data read access in Data Fabric if you are using API aggregation. > [!NOTE] > > Scope options vary by UiPath version. For more information, refer to the following resources in the UiPath documentation: - [Personal Access Tokens]() - [Using Personal Access Tokens for API Authentication]() > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. # UiPath Provisioning Settings This section contains the information used to create, update, enable, disable, and delete accounts by triggering RPA workflows. > [!IMPORTANT] > > - UiPath cannot run multiple workflows simultaneously. This may affect the Bulk Provisioning Operations. > - Data Fabric and the CSV file must contain an attribute named `accountStatus` (a boolean attribute where `TRUE` means the account is enabled) exists in the data and that it is mapped to set the Account Status (Enabled/Disabled) in SailPoint. This attribute is only required if you want to use the Enable/Disable operation. ## Folder Configuration Configure the Provisioning Organization Unit ID if your provisioning workflows are in a folder other than the default Organization Unit ID folder. ##### Screenshot [![Provision organization ID screenshot]()]() 1. Enter your **Provisioning Organization Unit ID** if your provisioning workflows are in a folder other than the default Organization Unit ID folder. For more information, refer to [Organization Unit ID](). 2. Select **Save**. ## Operation Configuration Configure which UiPath processes to trigger for each provisioning operation. You can find release keys in UiPath Orchestrator under **Automations \> Processes**. Release keys are unique identifiers for specific RPA workflow processes in UiPath Orchestrator. Each provisioning operation requires its own workflow and corresponding release key. ##### Screenshot [![Operation configuration screenshot]()]() 1. Enter the UiPath process release key in the **CREATE Release Key** field to trigger when creating new accounts. 2. Enter the UiPath process release key in the **UPDATE Release Key** field to trigger when updating accounts. 3. Enter the UiPath process release key in the **ENABLE Release Key** field to trigger when enabling accounts. 4. Enter the UiPath process release key in the **DISABLE Release Key** field to trigger when disabling accounts. 5. Enter the UiPath process release key in the **DELETE Release Key** field to trigger when deleting accounts. 6. Select **Save**. ## Advanced Polling Settings Configure settings to adjust polling when connecting to the source. This may help resolve timeout errors that occur during provisioning operations. ##### Screenshot [![Polling settings screenshot]()]() 1. In the **Max Poll Attempts** field, enter the maximum number of times the connector should check the job status. If the job doesn't complete after the configured number of checks, it times out. 2. In the **Poll Interval in Seconds** field, enter the wait time between job status checks. Increase this value if your workflows take longer to complete. 3. Select **Save**. ## Operation-Specific Guidelines This section provides detailed guidance for provisioning operations in the UiPath RPA platform. ### Best Practices - **Return a clear result**: Always set `Status` and, on failure, set a `message` so Support can troubleshoot. The response should have the required attributes. - **Always return `OutputArguments`**: The connector requires `OutputArguments` with `Status`. Set `Status: true` on success and `Status: false` on failure. - **Return the created identity**: Always include the identity attribute in `Attributes` with the final value. - **Idempotency**: If the same operation is retried, consider designing the target system or workflow so it does not create duplicates (e.g. "create if not exists" or use a stable identifier). - **Errors**: On failure, set `Status: false` and put a short, user-friendly reason in `message`; avoid exposing sensitive details. - **Logging**: Log input and outcome (success or failure) in UiPath for auditing and support; avoid logging secrets in plain text. Log identity, which buckets had data, and outcome; avoid logging secrets. - **Atomic Operations** - If the create operation partially fails, for example if the account is created but role assignment fails: - **Option A**: Rollback the partially created account then set `Status = false`. - **Option B**: Complete what's possible, then set `Status = true`. Note the issue in a message. > **Note** > > SailPoint recommends that you rollback for consistency. - **Apply set / add / remove correctly**: In the target system, implement `Set` as "replace value", `Add` as "append to list", `Remove` as "remove these values from list" so the behavior matches the connector's intent. - **Return current state**: Prefer returning the updated account's attributes in `Attributes` (at least identity + any attributes your workflow changes) so the connector can merge and show up-to-date data. ### CREATE Operations The connector starts a UiPath job (release) when a create account request is run; the workflow receives input, creates the account in the target system, and returns a result. Configure the create release in the connector config (e.g. `createReleaseKey`). The workflow must be the one attached to that release. #### Input Arguments The connector sends a single string in the job's `InputArguments`. When the workflow parses it, it will be a JSON object (flat key-value). The input contains one key per attribute from the provisioning request. Names and sets of attributes depend on the account schema and what the request contains. For example, `Email`, `displayName`, `Roles`, etc. The connector does not send the following: - Null or empty string values - Reserved names used only for output. Names such as `Status`, `message`, or `Attributes`. The workflow can expect the following value types: - Strings - Arrays of strings - Integers - Booleans The workflow receives the same attribute names as in the schema (e.g. `Email`, `accountId`). The identity attribute's name is defined in the connector's account schema. **Input Arguments Example** > [!NOTE] > > The exact keys depend on the schema and request. ```text {"Email":"john.doe@example.com","displayName":"John Doe","Roles":["Admin"]} ``` #### Workflow Responsibilities 1. **Validate Input** - Check all required fields are present. 2. **Check for Duplicates** 1. Search the target system for an existing account with same email or username. 2. If one exists, set `Status = false` and return an error message. For example: "Account with email [john.doe@company.com]() already exists" 3. **Create Account** - Go to the user creation interface. - Fill in all the provided attributes. - Submit form / call API. - Wait for confirmation. 4. **Assign Initial Entitlements** (if specified) - Add the user to their specified roles/groups. - Assign default permissions. 5. **Verify Creation** - Search for newly created accounts. - Confirm that they exist and they are active. - If verification fails, set `Status = false`. 6. **Capture Account Details** - Scrape all account attributes from the confirmation page or the API response. - **Critical**: Capture system-generated fields (account ID, timestamps). - **Critical**: Ensure the identity attribute is captured. 7. **Return Output** - Set `Status = true` if successful. - Include a success message. - Include complete account data in the Attributes field. #### Output Arguments The connector reads the job's `OutputArguments` after the job completes. `OutputArguments` must be a JSON string that parses to an object with the following: | Field | Type | Required | Description | | --- | --- | --- | --- | | Status | boolean | Yes | `true` = success.

`false` = failure.

If `false`, the connector fails the request and can use a configured `message`. | | message | string | Recommended | Short reason or detail, especially when `Status` is `false`. | | Attributes | string | Yes | A JSON string that, when parsed, is an object of account attributes. It must include the identity attribute with the created account's ID. Other attributes returned here can be used to show the created account in the identity system. The identity attribute must be present in the parsed `Attributes` object and must have a non-empty value.

**Note:** The connector uses this to recognize the created account. The exact name is defined in the connector's account schema.

**Example:**
`{"Status":true,"message":"Account created","Attributes":"{\"Email\":\"john.doe@example.com\",\"displayName\":\"John Doe\",\"Roles\":[\"Admin\"]}"}` | **Output Success Example** ```json { "Status": true, "message": "Account john.doe@company.com created successfully in SalesApp", "Attributes": "{\"email\":\"john.doe@company.com\",\"username\":\"jdoe\",\"firstName\":\"John\",\"lastName\":\"Doe\",\"department\":\"Engineering\",\"jobTitle\":\"Senior Developer\",\"manager\":\"jane.smith@company.com\",\"status\":\"Active\",\"roles\":[\"Developer\",\"User\"],\"accountId\":\"SA-12345\",\"createdDate\":\"2025-01-10T14:30:00Z\",\"lastModifiedDate\":\"2025-01-10T14:30:00Z\"}" } ``` **Output Failure Example - Duplicate** ```json { "Status": false, "message": "Cannot create account: Email john.doe@company.com already exists in SalesApp (Account ID: SA-11111)", "Attributes": "{}" } ``` **Output Failure Example - System Error** ```json { "Status": false, "message": "Failed to create account: Target system returned error 'Invalid department code: ENG01'. Please verify department value.", "Attributes": "{}" } ``` ### UPDATE Operations The connector starts a UiPath job (release) when an update account request is run. The workflow receives the account identity and what changed (`set` / `add` / `remove`), applies the changes in the target system, then returns a result. Configure the update release in the connector config (e.g. `updateReleaseKey`). The workflow must be the one attached to that release. #### Input Arguments The connector sends a single string in the job's `InputArguments`. When the workflow parses it, it will be a JSON object with a structured shape (not a flat list of attributes like CREATE). Top-level fields: | Field | Type | Description | | --- | --- | --- | | identity attribute | string | Same value as `accountId`; the name comes from connector's schema (e.g. `Email`). | | attributesToSet | object | Key-value: attributes to **set** (replace). Values can be string, number, boolean, or array of strings. | | attributesToAdd | object | Key-value: multi-valued attributes - add these values to the existing list. Values are typically arrays of strings. | | attributesToRemove | object | Key-value: multi-valued attributes - remove these values. Values are typically arrays of strings. | | operation | string | Always **UPDATE** for this workflow. | | timestamp | string | Request timestamp (e.g. for logging). | > [!NOTE] > > Only attributes that exist in the connector's account schema are included. Identity is sent once at the top level; it is not repeated inside the three buckets. Any of the three objects may be empty `{}` if there are no `set`/`add`/`remove` changes for that category. **Input Arguments Example** ```text {"accountId":"user@example.com","Email":"user@example.com","attributesToSet":{"displayName":"New Name"},"attributesToAdd":{},"attributesToRemove":{"Roles":["OldRole"]},"operation":"UPDATE","timestamp":"Wed Feb 04 12:00:00 GMT 2026"} ``` #### Workflow Responsibilities 1. **Locate Account** 1. Use the identity attribute value to find account in target system. 2. If an account is not found, set `Status = false` immediately. Example error: "Cannot update: Account [john.doe@company.com]() not found" 2. **Determine What Changed** 1. Checkout input attributes. 2. Identify additions, such as new roles using `attributesToAdd`. 3. Identify removals, such as removed roles using `attributesToRemove`. 4. Identify modifications, such as department change using `attributesToSet`. 3. **Apply Changes** 1. Update only the specified attributes. 2. Do not modify attributes not mentioned in input. 3. Navigate to edit interface. 4. Make changes. 5. Save the changes. 4. **Verify Changes** - Re-read account data from target system. - Confirm changes applied correctly. - If verification fails, consider rolling back the changes. 5. **Capture Updated State** - Scrape all current account attributes. - **Critical**: Include identity attribute. - Include both changed and unchanged attributes (full account state). 6. **Return Output** - Set Status = true if all changes applied. - Describe what was changed in a message. - Include complete account data in the Attributes field. #### Output Arguments The connector reads the job's `OutputArguments` after the job completes. `OutputArguments` must be a JSON string that parses to an object with the following: | Field | Type | Required | Description | | --- | --- | --- | --- | | Status | boolean | Yes | `true` = success.

`false` = failure.

If `false`, the connector fails the request and can use a configured `message`. | | message | string | Recommended | Short reason or detail, especially when `Status` is `false`. | | Attributes | string | Yes | A JSON string that parses to an object of account attributes. Must include the identity attribute (e.g. `Email` or `accountId`) with the updated account's ID (usually unchanged). Other attributes returned here are merged with existing account data so the identity system shows the latest state.

**Note:** The identity attribute must be present in the parsed `Attributes` object and must have a non-empty value.

**Example:**
`{"Status":true,"message":"Account created","Attributes":"{\"Email\":\"john.doe@example.com\",\"displayName\":\"John Doe\",\"Roles\":[\"Admin\"]}"}` | **Output Success Example** ```json { "Status": true, "message": "Account updated: Changed department from Engineering to Sales, changed job title to Sales Engineer, added Sales role", "Attributes": "{\"email\":\"john.doe@company.com\",\"username\":\"jdoe\",\"firstName\":\"John\",\"lastName\":\"Doe\",\"department\":\"Sales\",\"jobTitle\":\"Sales Engineer\",\"manager\":\"bob.jones@company.com\",\"status\":\"Active\",\"roles\":[\"Developer\",\"User\",\"Sales\"],\"lastModifiedDate\":\"2025-01-10T16:15:00Z\"}" } ``` **Output Failure Example - Account Not Found** ```json { "Status": false, "message": "Cannot update account: User john.doe@company.com not found in SalesApp. Account may have been deleted.", "Attributes": "{}" } ``` ### DELETE, ENABLE, and DISABLE Operations The connector starts a UiPath job (release) when a DELETE, ENABLE, or DISABLE account request is run. The workflow receives the account identity, then it deletes, activates, or deactivates the account in the target system, and optionally returns a result. Configure the DELETE, ENABLE, or DISABLE release in the connector configuration (e.g. `deleteReleaseKey`, `enableReleaseKey`, and `disableReleaseKey`). The workflow must be the one attached to that release. > [!IMPORTANT] > > To use ENABLE or DISABLE account operations, ensure that an attribute named `accountStatus` is included in the data and that it is mapped to set the Account Status (`enabled` or `disabled`) in SailPoint. The attribute `accountStatus` is a boolean attribute where `TRUE` means the account is enabled. #### Input Arguments The connector sends a single string in the job's `InputArguments`. When the workflow parses it, it will be a JSON object with the account to modify as well as metadata. Top-level fields: | Field | Type | Description | | --- | --- | --- | | identity attribute | string | The account to modify. The name comes from the connector schema (e.g. Email). This is the only identity field sent. | | operation | string | DELETE, ENABLE, or DISABLE | | timestamp | string | Request timestamp (e.g. for logging). | **Input Arguments Example** ```text {"Email":"user@example.com","operation":"DELETE","timestamp":"Wed Feb 04 12:00:00 GMT 2026"} {"Email":"user@example.com","operation":"ENABLE","timestamp":"Wed Feb 04 12:00:00 GMT 2026"} {"Email":"user@example.com","operation":"DISABLE","timestamp":"Wed Feb 04 12:00:00 GMT 2026"} ``` #### Output Arguments - `OutputArguments` are required. The connector requires the job to complete successfully and to return valid `OutputArguments`. - If `OutputArguments` is missing, empty, or not valid JSON, the connector fails the request. - `OutputArguments` must be a JSON string that parses to an object containing: - `Status` (boolean): Required. Must be `true` for success. If Status is `false`, the connector fails the request and uses message as the error reason. - `message` (string): Recommended (especially when Status is `false`); short reason for success or failure. - Attributes are not required. The connector does not read or validate an Attributes field for this operation. **Output Arguments Examples** ##### DELETE Success ```text {"Status":true,"message":"Account deleted"} ``` Failure ```text {"Status":false,"message":"Account not found or already removed"} ``` ##### ENABLE Success ```text {"Status":true,"message":"Account enabled"} ``` Failure ```text {"Status":false,"message":"Account not found or already enabled"} ``` ##### DISABLE Success ```text {"Status":true,"message":"Account disabled"} ``` Failure ```text {"Status":false,"message":"Account not found or already disabled"} ``` # UiPath Troubleshooting If you encounter any of the following issues or errors while configuring the UiPath RPA platform, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Connection test failed: Unknown host **Cause**: Base URL is incorrect or network cannot resolve hostname **Resolution**: 1. Verify the base URL format: - Correct - `https://cloud.uipath.com/mycompany` - Incorrect - `https://cloud.uipath.com/mycompany/orchestrator_/` 2. Check for typos in the hostname. 3. Verify DNS resolution (ping the hostname). 4. Check that the firewall allows outbound HTTPS (port 443). 5. Confirm the UiPath tenant is active (not suspended). ## Connection test failed: 401 Unauthorized **Cause**: API token is invalid, expired, or incorrect **Resolution**: 1. Generate a new API token in UiPath: 1. Go to **UiPath Admin \> API Access**. 2. Create a new personal access token. 3. Copy the token immediately, as it cannot be viewed again. 2. Paste the new token into SailPoint configuration. 3. Verify the token hasn't expired (check expiration date in UiPath). 4. Ensure the token is for the correct tenant or folder. 5. Verify that the service account has API access permissions. ## Connection test failed: 403 Forbidden **Cause**: API token lacks required permissions **Resolution**: 1. Check token permissions in UiPath: - Must have the **View** permission on Orchestrator. - Must have the **Execute** permission for jobs. - Must have the **Read** permission on Data Fabric, if you're using API aggregation. 2. Use an account with Administrator role (for testing). 3. Review the organizational unit permissions. 4. Ensure that the token is not restricted to specific folders. ## Connection test failed: 404 Not Found **Cause**: Incorrect Organization Unit ID or base URL **Resolution**: 1. Verify the Organization Unit ID: 1. Log into UiPath Orchestrator. 2. Go to the target folder. 3. Check URL for the `fid=` parameter. This is your Organization Unit ID. For example in `.../folders?fid=123456`, the Organization Unit ID is `123456`. 2. Verify the base URL doesn't include the `/orchestrator_` or `/dataservice_` service paths. 3. Confirm that the folder exists and is accessible to API token. ## No records returned from aggregation **Cause**: Empty data source or incorrect configuration **Resolution**: **For Data Fabric** (UiPath) 1. Verify the Data Fabric entity has records: 1. Log into the UiPath Data Service. 2. Query the entity manually. 3. Confirm that the records exist. 2. Check that `dataFabricEntityId` matches entity name exactly. 3. Verify that the API token has read permission on the entity. 4. Check that the Organization Unit ID is correct. **For SFTP** 1. Verify that the CSV file exists at the specified path. 2. Check that the file contains data rows, not just headers. 3. Verify that the file format is correct; a proper CSV with header row. 4. Confirm that the SFTP user can read the file. ## Aggregation times out **Cause**: Large dataset or slow network **Resolution**: 1. Check record count: 1. **Data Fabric**: Query entity, check the `totalRecordCount` attribute. 2. **SFTP**: Check the CSV file size/row count. 2. If \>10,000 records: 1. Expect one to two hours for aggregation duration. 2. Increase timeout settings in SailPoint (if configurable). 3. Consider scheduling during off-peak hours. 3. Optimize the data source: 1. Remove unused attributes (fewer columns). 2. Filter out inactive accounts (if possible). 4. Check network speed between SailPoint and the SFTP server. ## Release key not found **Cause**: The release key is incorrect or the workflow is not deployed **Resolution**: 1. Verify that the release key in SailPoint matches the one in UiPath: 1. Log into UiPath Orchestrator. 2. Go to **Processes**. 3. Find your workflow. 4. Select **Workflow \> View details**. 5. Copy the **Key** field value. 6. Paste it into the SailPoint configuration. 2. Ensure the workflow is deployed, not just published. The workflow must be in **Processes**, not just in **Packages**. 3. Check that the workflow is in the correct folder or organizational unit. 4. Verify that the API token has execute permissions on the workflow.