# Configuring Web Services Entitlements

## Multiple Group Objects

The Web Services source supports multiple group objects. Add a new endpoint for newly introduced groups or entitlements, such as:

- Group Aggregation - `<GROUP-SCHEMA-OBJECT-TYPE>`
- Get Object - `<GROUP-SCHEMA-OBJECT-TYPE>`
- Add Entitlement - `<GROUP-SCHEMA-OBJECT-TYPE>`
- Remove Entitlement - `<GROUP-SCHEMA-OBJECT-TYPE>`

Refer to the [listSchema](<https://developer.sailpoint.com/docs/api/get-source-schemas-v-1/>) API and [createSchema](<https://developer.sailpoint.com/docs/api/create-source-schema-v-1/>) API for more information.

> [!NOTE]
>
> **Adding a New Group Schema**
>
> To support multi groups, add the following API to add a new schema:
>
> - **Method** - `POST`
> - **URI** - `/sources/<source-id>/schemas`
> - **JSON Payload**:
>
> The following JSON example adds the schema for the Role that follows:
>
> ```json
> {
>     "name": "Role",
>     "nativeObjectType": "Role",
>     "identityAttribute": "Id",
>     "displayAttribute": "Name",
>     "hierarchyAttribute": null,
>     "includePermissions": false,
>     "features": [],
>     "configuration": {},
>     "attributes": [
>         {
>             "name": "Id",
>             "type": "STRING",
>             "schema": null,
>             "description": "Role Id.",
>             "isMulti": false,
>             "isEntitlement": false,
>             "isGroup": false
>         },
>         {
>             "name": "Name",
>             "type": "STRING",
>             "schema": null,
>             "description": "Role name.",
>             "isMulti": false,
>             "isEntitlement": false,
>             "isGroup": false
>         }
>     ]
> }
> ```
>
> The resulting Role:
>
> ```xml
> <Schema displayAttribute="Name" identityAttribute="Id" nativeObjectType="Role" objectType="Role">
> <AttributeDefinition name="Id" type="string">
> <Description>Role Id.</Description>
> </AttributeDefinition>
> <AttributeDefinition name="Name" type="string">
> <Description>Role name.</Description>
> </AttributeDefinition>
> </Schema>
> ```

> [!NOTE]
>
> **Updating the Existing Account Schema**
>
> As the new group schema (for role object type) has been created, update the relevant account schema attributes to point to the new group schema by making changes in the account schema through the UI, as SailPoint allows you to add the new entitlement in the account schema.

> [!NOTE]
>
> **Add New Endpoint**
>
> Add a new endpoint for Group Aggregation, Get Object, and Add/Remove Entitlement operations. Update the `connectionParameters` attribute using the PATCH method as follows:
>
> 1. Add a new dummy endpoint such as Test Connection, Account Aggregation from the SailPoint UI and save it.
> 2. With the PATCH API, replace the required operation type with the respective operation type, such as:
>
>    1. Group Aggregation `<GROUP-SCHEMA-OBJECT-TYPE>`
>    2. Get Object `<GROUP-SCHEMA-OBJECT-TYPE>`
>    3. Add Entitlement `<GROUP-SCHEMA-OBJECT-TYPE>`
>    4. Remove Entitlement `<GROUP-SCHEMA-OBJECT-TYPE>`
>
>       Method - `POST`
>
>       URI - `beta/sources/<source-id>/schemas`
>
>       JSON Payload:
>
>       ```json
>       [
>           {"op":"add","path":"/connectorAttributes/connectionParameters/0/operationType","value":"Group Aggregation-Role"},
>           {"op":"add","path":"/connectorAttributes/connectionParameters/1/operationType","value":"Get Object - Role"},
>           {"op":"add","path":"/connectorAttributes/connectionParameters/2/operationType","value":"Add Entitlement-Role"},
>           {"op":"add","path":"/connectorAttributes/connectionParameters/3/beforeRule","value":"Remove Entitlement-Role"}
>       ]
>       ```

> [!IMPORTANT]
>
> Localization is not applicable for the value of the `OperationType` attribute added from the API. If you provide the operation type in a language other than English, the Web Services source does not configure the group aggregation type (for example, Groepsaggregatie - Rol).

## Configuring Multiple Entitlement Requests

The connector can send a single request for several instances of one entitlement type to the managed system. For example, you can send a single request for several instances of `RoleID`.

> [!NOTE]
>
> The connector must send multiple requests for different entitlement types. However, each request for that entitlement type can include several instances.

To enable this feature, set the `addRemoveEntInSingleReq` parameter to `true` as follows:

```xml
<entry key="addRemoveEntInSingleReq">
   <value>
       <Boolean>true</Boolean>
   </value>
</entry>
```

You can configure the value of this attribute using the SailPoint REST API. Refer to [SailPoint REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1>) for more information.

```json
[
  {
    "op": "replace",
    "path": "/connectorAttributes/addRemoveEntInSingleReq",
    "value": "true"
  }
]
```

The following is an example of the payload:

```json
{
  "RoleID": $plan.addRoleIds$
}
```

- If `addRemoveEntInSingleReq` is set to `false`, then the placeholder value for the attribute marked as an entitlement is passed in separate API requests:

  First request payload:

  ```text
  jsonBody={ "RoleID": "9dd23398-b905-4878-b7ad-bc02d22171d9" }
  ```

  Second request payload:

  ```text
  jsonBody={ "RoleID": "8defe39c0-54f6-47b4-8a15-fcc2622923sk" }
  ```
- If `addRemoveEntInSingleReq` is set to `true`, then the placeholder value for the attribute marked as an entitlement is passed as an array and is executed in a single request:

  Single request payload:

  ```text
  jsonBody={ "RoleID": ["97ee39c0-54f6-47b4-8a15-fcc262292386","8defe39c0-54f6-47b4-8a15-fcc2622923sk"] }
  ```

## Add Entitlements When Enabling Accounts

When you enable accounts via provisioning, you can associate entitlements with it at the same time.

To configure the connector to add entitlements to accounts you enable, add the following to your provisioning plan:

```xml
<ProvisioningPlan>
    <AccountRequest op="Enable">
        <AttributeRequest name="<Entitlement_Name>" op="Add" value="<Entitlement_Value>">
        </AttributeRequest>
        <AttributeRequest name="<Entitlement_Name>" op="Add" value="<Entitlement_Value>">
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>
```

> [!NOTE]
>
> In the provisioning plan entry, substitute the attribute's name where the example says `<Entitlement_Name>` and the desired value for `<Entitlement_Value>`. Add additional `AttributeRequest` entries to add more entitlements.

## Remove Entitlements When Disabling Accounts

When you disable accounts via provisioning, you can remove any associated entitlements at the same time.

To configure the connector to remove entitlements from accounts you disable, add the following to your provisioning plan:

```xml
<ProvisioningPlan>
    <AccountRequest op="Disable">
        <AttributeRequest name="Entitlement_Name" op="Remove" value="Entitlement_Value">
        </AttributeRequest>
        <AttributeRequest name="Entitlement_Name" op="Remove" value="Entitlement_Value">
        </AttributeRequest>
    </AccountRequest>
</ProvisioningPlan>
```

> [!NOTE]
>
> In the provisioning plan entry, substitute the attribute's name where the example says `<Entitlement_Name>` and the desired value for `<Entitlement_Value>`. Add additional `AttributeRequest` entries to remove more entitlements.