# Configuring Web Services SaaS Entitlements

## Multiple Group Objects

The Web Services source supports multiple group objects. Add a new endpoint for newly introduced groups or entitlements, such as:

- Group Aggregation - `<GROUP-SCHEMA-OBJECT-TYPE>`
- Get Object - `<GROUP-SCHEMA-OBJECT-TYPE>`
- Add Entitlement - `<GROUP-SCHEMA-OBJECT-TYPE>`
- Remove Entitlement - `<GROUP-SCHEMA-OBJECT-TYPE>`

Refer to the [listSchema](<https://developer.sailpoint.com/docs/api/get-source-schemas-v-1/>) API and [createSchema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) API for more information.

> [!NOTE]
>
> **Adding a New Group Schema**
>
> To support multi groups, add the following API to add a new schema:
>
> - **Method** - `POST`
> - **URI** - `/sources/<source-id>/schemas`
> - **JSON Payload**:
>
> The following JSON example adds the schema for the Role that follows:
>
> ```json
> {
>     "name": "Role",
>     "nativeObjectType": "Role",
>     "identityAttribute": "Id",
>     "displayAttribute": "Name",
>     "hierarchyAttribute": null,
>     "includePermissions": false,
>     "features": [],
>     "configuration": {},
>     "attributes": [
>         {
>             "name": "Id",
>             "type": "STRING",
>             "schema": null,
>             "description": "Role Id.",
>             "isMulti": false,
>             "isEntitlement": false,
>             "isGroup": false
>         },
>         {
>             "name": "Name",
>             "type": "STRING",
>             "schema": null,
>             "description": "Role name.",
>             "isMulti": false,
>             "isEntitlement": false,
>             "isGroup": false
>         }
>     ]
> }
> ```
>
> The resulting Role:
>
> ```xml
> <Schema displayAttribute="Name" identityAttribute="Id" nativeObjectType="Role" objectType="Role">
> <AttributeDefinition name="Id" type="string">
> <Description>Role Id.</Description>
> </AttributeDefinition>
> <AttributeDefinition name="Name" type="string">
> <Description>Role name.</Description>
> </AttributeDefinition>
> </Schema>
> ```

> [!NOTE]
>
> **Updating the Existing Account Schema**
>
> As the new group schema (for role object type) has been created, update the relevant account schema attributes to point to the new group schema by making changes in the account schema through the UI, as SailPoint allows you to add the new entitlement in the account schema.

> [!NOTE]
>
> **Add New Endpoint**
>
> Add a new endpoint for Group Aggregation, Get Object, and Add/Remove Entitlement operations. Update the `connectionParameters` attribute using the PATCH method as follows:
>
> 1. Add a new dummy endpoint such as Test Connection, Account Aggregation from the SailPoint UI and save it.
> 2. With the PATCH API, replace the required operation type with the respective operation type, such as:
>
>    1. Group Aggregation `<GROUP-SCHEMA-OBJECT-TYPE>`
>    2. Get Object `<GROUP-SCHEMA-OBJECT-TYPE>`
>    3. Add Entitlement `<GROUP-SCHEMA-OBJECT-TYPE>`
>    4. Remove Entitlement `<GROUP-SCHEMA-OBJECT-TYPE>`
>
>       Method - `POST`
>
>       URI - `beta/sources/<source-id>/schemas`
>
>       JSON Payload:
>
>       ```json
>       [
>           {"op":"add","path":"/connectorAttributes/connectionParameters/0/operationType","value":"Group Aggregation-Role"},
>           {"op":"add","path":"/connectorAttributes/connectionParameters/1/operationType","value":"Get Object - Role"},
>           {"op":"add","path":"/connectorAttributes/connectionParameters/2/operationType","value":"Add Entitlement-Role"},
>           {"op":"add","path":"/connectorAttributes/connectionParameters/3/beforeRule","value":"Remove Entitlement-Role"}
>       ]
>       ```

> [!IMPORTANT]
>
> Localization is not applicable for the value of the `OperationType` attribute added from the API. If you provide the operation type in a language other than English, the Web Services source does not configure the group aggregation type (for example, Groepsaggregatie - Rol).

## Configuring Multiple Entitlement Requests

To enable the connector to send multiple entitlement requests of different enlistment types in a single request to the managed system, set the `addRemoveEntInSingleReq` parameter to `true` as follows:

```xml
<entry key="addRemoveEntInSingleReq">
   <value>
       <Boolean>true</Boolean>
   </value>
</entry>
```

You can configure the value of this attribute using the SailPoint REST API. Refer to [SailPoint REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1>) for more information.

The following is an example of the payload:

```json
{
  "addRoleIds": $plan.addRoleIds$
}
```

- If `addRemoveEntInSingleReq` is set to `false`, then the placeholder value for the attribute marked as an entitlement is passed in separate API requests:

  First request payload:

  ```text
  jsonBody={ "addRoleIds": "9dd23398-b905-4878-b7ad-bc02d22171d9" }
  ```

  Second request payload:

  ```text
  jsonBody={ "addRoleIds": "8defe39c0-54f6-47b4-8a15-fcc2622923sk" }
  ```
- If `addRemoveEntInSingleReq` is set to `true`, then the placeholder value for the attribute marked as an entitlement is passed as an array and is executed in a single request:

  Single request payload:

  ```text
  jsonBody={ "addRoleIds": ["97ee39c0-54f6-47b4-8a15-fcc262292386","8defe39c0-54f6-47b4-8a15-fcc2622923sk"] }
  ```

## Child Hierarchy

The Web Services SaaS connector supports child hierarchy for entitlements. To achieve this, perform the following:

1. Add the `hierarchyAttribute` property to the entitlementSchemas.
2. Add the `childHierarchy: true` property to the child entitlement.

Refer to the API [Uploads source entitlements schema](<https://developer.sailpoint.com/docs/api/import-entitlements-schema-v-1>) and [Update Source Schema (Partial)](<https://developer.sailpoint.com/docs/api/update-source-schema-v-1/>) in the SailPoint Developer Community for more information.

> [!NOTE]
>
> **Sample Schema**
>
> The following example marks the `roles` attribute on a Role entitlement schema as supporting a child hierarchy:
>
> ```xml
> <Schema displayAttribute="name" identityAttribute="sys_id" nativeObjectType="sys_user_role" objectType="Role">
>   <AttributeDefinition multi="true" name="roles" type="string">
>     <Description>List of roles contained within the role</Description>
>   </AttributeDefinition>
>   <Attributes>
>     <Map>
>       <entry key="childHierarchy" value="true"/>
>     </Map>
>   </Attributes>
> </Schema>
> ```

## Direct Permissions

The Web Services SaaS connector can read direct permissions for accounts. Configure direct permissions using after list account operations in customizers. Refer to [Customizers](<https://documentation.sailpoint.com/connectors/web_services/saas/help/customizers.html>) for more information.

To add direct permissions for accounts, add the desired object to the `permissions` attribute under `StdAccountListOutput` as follows:

```typescript
.afterStdAccountList(async (context: Context, output: StdAccountListOutput) => {
    const permissions = [] as unknown as Permission[];
    const permission = {} as Permission;
    permission.annotation = 'annotationValue';
    permission.rights = 'rightsValue';
    permission.target = 'targetValue';
    output.permissions = permissions;
    return output
})
```

> [!NOTE]
>
> Configuring direct permissions requires additional processing, which may result in an increased duration of time to complete aggregation processes.