Skip to content

Workflow Actions

Each workflow action receives input from the data flow and performs an action in IdentityNow. The values you enter in the fields for each action help determine what is done and how. The result of each action, in JSON format, is added to the workflow's data flow.

The value for each field must be either a variable from a previous step or a static, fixed value. Select which format you'll be using for each field before entering the value and saving your workflow.

Every action has a name and an optional description field. The name of the action must be unique within the workflow so it can be used in Next steps and conditional logic. The workflow builder automatically generates the action name based on the action type.

Each action is allowed a period of time before it times out. If an action times out, the workflow fails.

Below, you can find a list of all actions currently available for workflows, as well as the unique fields and timeout period for each action. If a particular action adds any JSON to the workflow, a sample of that JSON is available.

Access Request Actions

Actions related to creating and managing access requests.

Approve Access Request

Approves an access request with the selected ID and leaves a comment.

Field Required? Description
Access Request ID Yes The ID of the access request to approve.
Comment Yes Provide a comment to leave on the access request's approval.

If you add this action to your workflow and you don't have the Access Request service, your workflow will fail. This step will time out if it takes longer than 90 seconds to complete.

Create Request for Access

Submits an access request for the selected list of users.

The Create Request for Access step has been replaced by the Manage Access step. To create an access request in a workflow, use the Manage Access step and select Add Access.

This step will time out if it takes longer than 90 seconds to complete.

Deny Access Request

Denies an access request by ID and leaves a comment.

Field Required? Description
Access Request ID Yes The ID of the access request to deny.
Comment Yes Provide a comment to leave on the access request's denial.

If you add this action to your workflow and you don't have the Access Request service, your workflow will fail. This step will time out if it takes longer than 90 seconds to complete.

Get Access Request Recommendations

Gets a list of the recommended access requests for the specified user.

Field Required? Description
Get Access Request Recommendations Yes The ID of the identity for whom to retrieve access request recommendations.

If you add this action to your workflow and you don't have the Access Request and Recommendations AI services, your workflow will fail.

This step will time out if it takes longer than 90 seconds to complete.

This action returns a JSON blob when it completes successfully.

Open "Get Access Request Recommendation" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
{
    "response":[
        {
            "request":{
                "identityId":"2c91803654683da6017468123c260195",
                "item":{
                    "id":"2c938083633d259901633d2623ec0375",
                    "type":"ENTITLEMENT"
                }
            },
            "recommendation":"YES",
            "interpretations":[
                "75% of identities with the same department have this access. This information had a high impact on the overall score.",
                "67% of identities with the same peer group have this access. This information had a low impact on the overall score.",
                "42% of identities with the same location have this access. This information had a low impact on the overall score."
            ],
            "translationMessages":[
                {
                    "key":"recommender-api.V2_WEIGHT_FEATURE_PRODUCT_INTERPRETATION_HIGH",
                    "values":[
                        "75",
                        "department"
                    ]
                }
            ],
            "recommenderCalculations":{
                "identityId":"2c91808457d8f3ab0157e3e62cb4213c",
                "entitlementId":"2c91809050db617d0150e0bf3215385e",
                "recommendation":"YES",
                "overallWeightedScore":0,
                "featureWeightedScores":{
                    "property1":0,
                    "property2":0
                },
                "threshold":0,
                "identityAttributes":{
                    "property1":{
                        "value":"string"
                    },
                    "property2":{
                        "value":"string"
                    }
                },
                "featureValues":{
                    "feature":"department",
                    "numerator":0,
                    "denominator":0
                }
            }
        }
    ]
}

Get Pending Access Requests

Gets up to 250 pending access requests.

Field Description
Reviewer Select a reviewer. All access requests that list that identity as one of their reviewers will be returned.
Filter Results Optionally apply additional filters using the Standard Collection Parameters.

This step will time out if it takes longer than 1 minute to complete.

Open "Get Pending Access Requests" JSON Sample 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
[
    {
        "id":"id12345",
        "name":"aName",
        "created":"2017-07-11T18:45:37.098Z",
        "modified":"2018-07-25T20:22:28.104Z",
        "requestCreated":"2017-07-11T18:45:35.098Z",
        "requestType":"GRANT_ACCESS",
        "requester":{
            "type":"IDENTITY",
            "id":"2c91808568c529c60168cca6f90c1313",
            "name":"William Wilson"
        },
        "requestedFor":{
            "type":"IDENTITY",
            "id":"2c91808568c529c60168cca6f90c1313",
            "name":"William Wilson"
        },
        "owner":{
            "type":"IDENTITY",
            "id":"2c91808568c529c60168cca6f90c1313",
            "name":"William Wilson"
        },
        "requestedObject":{
            "id":"2c9180835d2e5168015d32f890ca1581",
            "name":"Applied Research Access",
            "description":"Access to research information, lab results, and schematics",
            "type":"ROLE"
        },
        "requesterComment":{
            "comment":"Et quam massa maximus vivamus nisi ut urna tincidunt metus elementum erat",
            "author":{
                "type":"IDENTITY",
                "id":"2c91808568c529c60168cca6f90c1313",
                "name":"Adam Kennedy"
            },
            "created":"2017-07-11T18:45:37.098Z"
        },
        "previousReviewersComments":[
            {
                "comment":"Et quam massa maximus vivamus nisi ut urna tincidunt metus elementum erat",
                "author":{
                    "type":"IDENTITY",
                    "id":"2c91808568c529c60168cca6f90c1313",
                    "name":"Adam Kennedy"
                },
                "created":"2017-07-11T18:45:37.098Z"
            }
        ],
        "forwardHistory":[
            {
                "oldApproverName":"frank.mir",
                "newApproverName":"al.volta",
                "comment":"Fusce id orci vel consectetur amet ipsum quam.",
                "modified":"2019-08-23T18:52:57.398Z"
            }
        ],
        "commentRequiredWhenRejected":true,
        "actionInProcess":"APPROVED",
        "removeDate":"2020-07-11T00:00:00Z",
        "removeDateUpdateRequested":true,
        "currentRemoveDate":"2020-07-11T00:00:00Z",
        "sodViolationContext":{
            "state":"SUCCESS",
            "uuid":"f73d16e9-a038-46c5-b217-1246e15fdbdd",
            "violationCheckResult":{
                "message":{
                    "locale":"en-US",
                    "localeOrigin":"DEFAULT",
                    "text":"The request was syntactically correct but its content is semantically invalid."
                },
                "clientMetadata":{
                    "requestedAppName":"test-app",
                    "requestedAppId":"2c91808f7892918f0178b78da4a305a1"
                },
                "violationContexts":[
                    {
                        "policy":{
                            "type":"IDENTITY",
                            "id":"2c91808568c529c60168cca6f90c1313",
                            "name":"William Wilson"
                        },
                        "conflictingAccessCriteria":{
                            "leftCriteria":{
                                "criteriaList":[
                                    {

                                    }
                                ]
                            },
                            "rightCriteria":{
                                "criteriaList":[
                                    {

                                    }
                                ]
                            }
                        }
                    }
                ],
                "violatedPolicies":[
                    {
                        "type":"IDENTITY",
                        "id":"2c91808568c529c60168cca6f90c1313",
                        "name":"William Wilson"
                    }
                ]
            }
        }
    }
]

Request Access Removal

Requests the removal of one or more access items from a list of identities.

The Request Access Removal step has been replaced by the Manage Access step. To request access removal in a workflow, use the Manage Access step and select Remove Access.

This step will time out if it takes longer than 90 seconds to complete.

Certification Actions

Actions related to the creation or management of certification campaigns.

Activate Certification Campaign

Activates the certification campaign with the selected ID.

Field Required? Description
Campaign ID Yes The ID of the campaign to activate.

If you add this action to your workflow and you don't have the Certifications service, your workflow will fail. This step will time out if it takes longer than 2 hours to complete.

Create Certification Campaign

Creates a new certification campaign. The campaign must be activated separately.

Field Description
Campaign Name The name of the campaign.
Campaign Description A description of the campaign.
Reviewer Type The type of reviewer to use for this campaign. If you select Manager, a certification is created for all identities in your site and each identity's manager will review their access. You can also choose Source Owner to certify all access for one or more sources. If you choose Individual or Governance Group, you can select a specific identity or group to review the access of one or more identities or access items.
Campaign Duration The length of time the certification campaign should run. Choose a time period and then a unit.
AI Recommendations Choose whether or not to include recommendations from the Access Recommendations service in this campaign. If you don't have this service, this field is disabled.
Email Notifications Choose whether or not to send reminder emails associated with the campaign.
Start Campaign when Created Choose whether or not to activate the campaign once it's created. If you disable this option, you must activate the campaign separately.
Undecided Access Items Choose whether to maintain or automatically revoke undecided access items when the campaign ends.
If you selected Source Owner under Reviewer Type:
Source IDs Enter the IDs of all sources to include in the campaign. A single ID can be represented as a string. If including multiple IDs, enclose them in brackets and separate them with spaces. For example, [ID1 ID2 ID3]
If you selected Individual under Reviewer Type:
Reviewer Identity Select the identity that should be responsible for reviewing this certification.
Certification Type Choose whether to use an identity certification to certify the access of one or more identities, or to use an access certification to certify whether each identity that has specific access items should have that access.
If you selected Access Certification in Certification Type under Individual:
Access Type Choose the type of access to be included in this campaign.
Access Filter Choose whether to certify all access of the selected type or only specific access items. If you choose specific access items, use the Access Filter field to choose the IDs of access. You can also enter the ID values manually in a JSON array using this format: [“id1”, “id2”, “id3”]
If you selected Identity Certification in Certification Type under Individual:
Identities to Certify Select the identities to certify in the campaign.
If you selected Governance Group under Reviewer Type:
Governance Group Select a governance group to review this campaign.
Certification Type Choose whether to use an identity certification to certify the access of one or more identities, or to use an access certification to certify whether each identity that has specific access items should have that access.
If you selected Access Certification in Certification Type under Governance Group:
Access Type Choose the type of access to be included in this campaign.
Access Filter Choose whether to certify all access of the selected type or only specific access items. If you choose specific access items, use the Access Filter field to choose the IDs of access. You can also enter the ID values manually in a JSON array using this format: [“id1”, “id2”, “id3”]
If you selected Identity Certification in Certification Type under Governance Group:
Identities to Certify Select the identities to certify in the campaign.

If you add this action to your workflow and you don't have the Certifications service, your workflow will fail. This step will time out if it takes longer than 36 hours to complete.

This action returns a JSON blob when it completes successfully.

Open "Create Certification Campaign" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
{
    "id":"2c918086719eec070171a7e3355a360a",
    "name":"Manager Review",
    "description":"A review of everyone's access by their manager.",
    "deadline":"2020-12-25T06:00:00.123Z",
    "type":"MANAGER",
    "status":"ACTIVE",
    "emailNotificationEnabled":false,
    "autoRevokeAllowed":false,
    "recommendationsEnabled":false,
    "filter":{
       "type":"CAMPAIGN_FILTER",
       "id":"e0adaae69852e8fe8b8a3d48e5ce757c"
    }
}

Get Certification Campaign

Gets data about the specified certification campaign.

Field Required? Description
Campaign ID Yes The ID of the campaign to get.

If you add this action to your workflow and you don't have the Certifications service, your workflow will fail. This step will time out if it takes longer than 1 minute to complete.

This action returns a JSON blob when it completes successfully.

Open "Get Certification Campaign" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
{
    "id":"2c918086719eec070171a7e3355a360a",
    "name":"Manager Review",
    "description":"A review of everyone's access by their manager.",
    "deadline":"2020-12-25T06:00:00.123Z",
    "type":"MANAGER",
    "status":"ACTIVE",
    "emailNotificationEnabled":false,
    "autoRevokeAllowed":false,
    "recommendationsEnabled":false
}

Form

The Form action assigns the selected form to the specified user with a set deadline. The user receives an email notification with a link to fill out the form. The workflow is paused until the user completes and submits the form.

Forms that are used by workflows can be configured to use data values from the workflow by defining required form inputs. Map workflow variables to these form inputs and the variables can use conditions to pre-populate fields as the default form values. When defined, those inputs become required fields in the workflow form action configuration.

Field Description
Description Enter a description.
Form Search or select a form from the dropdown list. You can search by name or description.
Form Inputs If the selected form has any form inputs, they are displayed here as required fields. Map workflow variables to each of these form inputs to be used as values in the form.
Recipient Select the IdentityNow user to fill out the form.
Notification Subject Enter a subject line for the email notification.
Notification Body Enter the text of the email notification. The link to the form is automatically added to the end of the notification body.
Form Submission Deadline Select a deadline for how long the recipient has to complete the form. The maximum allowed time is 30 days or 720 hours.
Reminder Body Enter the text of the reminder email notification. The link to the form is automatically added to the end of the notification body.
Form Submission Reminder Select when to send a reminder notification if the form has not been submitted, up to 29 days or 696 hours.

Get Access

Gets a set of access items held by a selected identity or found through a search query.This step returns a maximum of 250 access items and is often used in conjunction with the Manage Access step.

Field Description
Access Selection Method Select how to determine the access that will be returned. Options are By Identity and By Search Query.
If you select By Identity:
By Identity Select an identity from the dropdown list, or use Choose Variable to select an identity from the input.
If you select By Search Query:
By Search Query Enter a search query to return specific access.

Underneath these fields, you select the checkbox beside the types of access you want to return. The options are access profiles, roles, and entitlements.

This step will time out if it takes longer than 1 minute to complete.

This action returns a JSON blob when it completes successfully. The sample JSON blob below includes an entitlement, a role, and an access profile. This is the format that the Manage Access step expects.

Open "Get Access" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
{
    "accessItems":[
        {
            "id":"2c9180847fdd00e1017ff5afb9c31f4e",
            "name":"CN=AD Access,OU=pod-name,DC=Test",
            "type":"entitlement"
        },
        {
            "id":"2c9180867ff523f4017ff5b17ff500af",
            "name":"Sales Role",
            "type":"role"
        },
        {
            "id":"2c9180887ff4d87e017ff5b1192b010e",
            "name":"Access to AD",
            "type":"accessprofile"
        }
    ]
}

Get Accounts

Gets one or more source accounts. This step returns a maximum of 250 accounts and is often used in conjunction with Manage Accounts.

Field Description
Account Selection Method Select By Identity to choose an identity and return its accounts. Select By Account Data to filter the accounts returned by details about the accounts.
If you selected By Identity:
Accounts By Identity Select an identity using the dropdown list or use Choose Variable to select the technical ID of an identity from the input. All accounts of the selected identity will be returned.
If you selected By Account Data:
Account Details Select an option to return accounts using details related to the account. options include the Technical ID of the account, the technical Identity ID, the Account Name, the native Account ID, the Source ID, and the Uncorrelated status.
Operator How to compare the value of the selected account detail with the Value field below. At this time, the valid option is Equals.
Value Enter a value to compare to the selected account detail you selected and return accounts that match your requirements.

This step will time out if it takes longer than 1 minute to complete.

This action returns a JSON blob when it completes successfully.

Open "Get Accounts" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
    "accounts":[
        {
            "id":"id12345",
            "name":"aName",
            "created":"2019-08-24T14:15:22Z",
            "modified":"2019-08-24T14:15:22Z",
            "sourceId":"2c9180835d2e5168015d32f890ca1581",
            "identityId":"2c9180835d2e5168015d32f890ca1581",
            "attributes":{

            },
            "authoritative":true,
            "description":"string",
            "disabled":true,
            "locked":true,
            "nativeIdentity":"string",
            "systemAccount":true,
            "uncorrelated":true,
            "uuid":"string",
            "manuallyCorrelated":true,
            "hasEntitlements":true
        }
    ]
}

HTTP Request

Makes an HTTP request to an external system. If the external system provides a response, it must be in JSON format.

This step will time out if it takes longer than 90 seconds to complete.

Field Description
Authentication Type The type of authentication to use. The options for this field are Basic Authentication, Custom Authorization, and OAuth 2.0 - Client Credentials Grant.
If you selected Basic Authentication:
User Name The user name authorized to access the HTTP service.
Password The password corresponding to the user name.
Method The HTTP method to use. The options are POST, GET, PUT, PATCH, and DELETE.
Request URL The URL of the service endpoint.
Query Parameters The parameters appended to the URL.
Request Headers The headers required by the service endpoint.
If you selected Custom Authorization:
Header Name The name or key required by the HTTP service.
Header Value The value required by the HTTP service.
Request URL The URL of the service endpoint.
Query Parameters The parameters appended to the URL.
Method The HTTP method to use. The options are POST, GET, PUT, PATCH, and DELETE.
If you selected OAuth 2.0 - Client Credentials Grant:
Token URL The URL to retrieve the token.
Client ID The client ID, similar to a user name.
Client Secret The client secret, similar to a password.
Credential Location Whether to include the credentials in the header or the body of the request. This is determined by the requirements of the external system being called. If the credentials are in the incorrect part of the request, the workflow might return a 401 error.
Scope The scope parameters required by some third-party systems. To include multiple scope values in a single parameter, separate values with spaces. To include multiple scope values in multiple parameters, separate values with new lines.
Request URL The URL of the service endpoint.
Query Parameters The parameters appended to the URL.
Request Headers The headers required by the service endpoint.
If you selected POST, PUT, or PATCH in the Method field of any of the above options:
Request Content Type The type of content to include in the request body. The options are CSV, Form, JSON, and plain text.
Request Body The body of your request in the format you specified.

Note

The HTTP Request action does not support endpoints requiring the QUIC protocol.

Identity Actions

Actions related to identities, their activity, and their attributes.

Get Identities

Gets data about a list of one or more identities, including all their default and custom attributes.

You can choose how to find the identities you want to manage. Additional fields will be displayed based on your choice.

In the Find Identities By field, choose an option. Additional fields appear when you select how to return identities.

Field Description
Search Query Enter a search query to return one or more identities.
Saved Search Choose a saved search from the dropdown list.
Tag Find identities that have a specific tag.
Managers Select one or more managers. All of the identities that report to one of those managers will be returned.
Direct Reports Select one or more identities. All of the managers of those identities will be returned.

This step will time out if it takes longer than 1 minute to complete.

This action returns a JSON blob when it completes successfully.

Open "Get Identities" JSON Sample 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
{
    "identities":[
        {
            "id":"2c9180865c45e7e3015c46c434a80622",
            "name":"ad.admin",
            "_type":"identity",
            "firstName":"AD",
            "lastName":"Admin",
            "displayName":"AD Admin",
            "email":"SLPT.CLOUD.SAILPOINT.TEST+AD-ADMIN@GMAIL.COM",
            "created":"2018-08-22T19:54:54.302Z",
            "modified":"2018-08-22T19:54:54.302Z",
            "synced":"2018-08-22T19:54:54.302Z",
            "phone":"512-942-7578",
            "inactive":false,
            "protected":false,
            "status":"UNREGISTERED",
            "employeeNumber":"O349804",
            "manager":null,
            "isManager":false,
            "identityProfile":{
                "id":"2c918085605c8d0601606f357cb231e6",
                "name":"E2E AD"
            },
            "source":{
                "id":"2c9180855c45b230015c46c19b9c0202",
                "name":"EndToEnd-ADSource"
            },
            "attributes":{
                "uid":"ad.admin",
                "firstname":"AD",
                "cloudAuthoritativeSource":"2c9180855c45b230015c46c19b9c0202",
                "cloudStatus":"UNREGISTERED",
                "iplanet-am-user-alias-list":null,
                "displayName":"AD Admin",
                "internalCloudStatus":"UNREGISTERED",
                "workPhone":"512-942-7578",
                "email":"SLPT.CLOUD.SAILPOINT.TEST+AD-ADMIN@GMAIL.COM",
                "lastname":"Admin"
            },
            "processingState":null,
            "processingDetails":null,
            "accounts":[
                {
                    "id":"2c9180865c45e7e3015c46c434a80623",
                    "name":"ad.admin",
                    "accountId":"CN=AD Admin,OU=slpt-automation,DC=TestAutomationAD,DC=local",
                    "source":{
                        "id":"2c9180855c45b230015c46c19b9c0202",
                        "name":"EndToEnd-ADSource",
                        "type":"Active Directory - Direct"
                    },
                    "disabled":false,
                    "locked":false,
                    "privileged":false,
                    "manuallyCorrelated":false,
                    "passwordLastSet":"2018-08-22T19:54:54.302Z",
                    "entitlementAttributes":{
                        "memberOf":[
                            "CN=Group Policy Creator Owners,CN=Users,DC=TestAutomationAD,DC=local",
                            "CN=Domain Guests,CN=Users,DC=TestAutomationAD,DC=local",
                            "CN=Domain Admins,CN=Users,DC=TestAutomationAD,DC=local",
                            "CN=Enterprise Admins,CN=Users,DC=TestAutomationAD,DC=local",
                            "CN=Schema Admins,CN=Users,DC=TestAutomationAD,DC=local",
                            "CN=Guests,CN=Builtin,DC=TestAutomationAD,DC=local",
                            "CN=Administrators,CN=Builtin,DC=TestAutomationAD,DC=local"
                        ]
                    },
                    "created":"2018-08-22T19:54:54.302Z"
                },
                {
                    "id":"2c918083606d670c01606f35a30a0349",
                    "name":"ad.admin",
                    "accountId":"ad.admin",
                    "source":{
                        "id":"ff8081815c46b85b015c46b90c7c02a6",
                        "name":"IdentityNow",
                        "type":"IdentityNowConnector"
                    },
                    "disabled":false,
                    "locked":false,
                    "privileged":false,
                    "manuallyCorrelated":false,
                    "passwordLastSet":null,
                    "entitlementAttributes":null,
                    "created":"2018-08-22T19:54:54.302Z"
                }
            ],
            "accountCount":2,
            "apps":[
                {
                    "id":"22751",
                    "name":"ADP Workforce Now",
                    "source":{
                        "id":"2c9180855c45b230015c46e2f6a8026a",
                        "name":"Corporate Active Directory"
                    },
                    "account":{
                        "id":"2c9180865c45efa4015c470be0de1606",
                        "accountId":"CN=Bob Wilson,OU=Austin,OU=Americas,OU=Demo,DC=seri,DC=acme,DC=com"
                    }
                }
            ],
            "appCount":1,
            "access":[
                {
                    "id":"2c918083634bc6cb01639808d40270ba",
                    "name":"test [AccessProfile-1527264105448]",
                    "displayName":"test",
                    "type":"ACCESS_PROFILE",
                    "description":"test",
                    "source":{
                        "id":"2c9180855c45b230015c46c19b9c0202",
                        "name":"EndToEnd-ADSource"
                    },
                    "owner":{
                        "id":"2c9180865c45e7e3015c46c434a80622",
                        "name":"ad.admin",
                        "displayName":"AD Admin"
                    }
                },
                {
                    "id":"2c9180865c45e7e3015c46c457c50755",
                    "name":"Administrators",
                    "displayName":"Administrators",
                    "type":"ENTITLEMENT",
                    "description":null,
                    "source":{
                        "id":"2c9180855c45b230015c46c19b9c0202",
                        "name":"EndToEnd-ADSource"
                    },
                    "privileged":false,
                    "attribute":"memberOf",
                    "value":"CN=Administrators,CN=Builtin,DC=TestAutomationAD,DC=local",
                    "standalone":false
                },
                {
                    "id":"2c9180865decdaa5015e06598b293108",
                    "name":"test [cloudRole-1503345085223]",
                    "displayName":"test",
                    "type":"ROLE",
                    "description":"test",
                    "owner":{
                        "id":"2c9180865c45e7e3015c46c5030707a0",
                        "name":"will.albin",
                        "displayName":"Albin Will"
                    },
                    "disabled":false
                }
            ],
            "accessCount":3,
            "accessProfileCount":1,
            "entitlementCount":1,
            "roleCount":1,
            "tags":[
                "TAG_1",
                "TAG_2"
            ]
        }
    ]
}

Get Identity

Gets data about a single identity, including all of their default and custom attributes.

Field Required? Description
Identity ID Yes The technical ID of the identity to get.

This step will time out if it takes longer than 1 minute to complete.

This action returns a JSON blob when it completes successfully.

Open "Get Identity" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
{
    "alias":"Abigail.5fd9918291",
    "attributes":{
       "cloudAuthoritativeSource":"2c91808a7e78ccef017e7901d4260195",
       "cloudStatus":"ACTIVE",
       "displayName":"Abigail 5fd9918291",
       "email":"Abigail.5fd9918291@testmail.identitysoon.com",
       "firstname":"Abigail",
       "internalCloudStatus":"ACTIVE",
       "lastSyncDate":"9fc13da4c7e4b960237b21949876ea8d3f3fc19c66b5e9b62dcccaa819db050e",
       "lastname":"5fd9918291",
       "personalEmail":"mail@example.com",
       "phone":"+1 416-797-0381",
       "uid":"Abigail.5fd9918291",
       "visibleSegments":[
          "85030dab-d253-43eb-95c6-b6023e8c127a"
       ],
       "workPhone":"512-942-7578"
    },
    "created":"2022-01-20T19:42:00.982Z",
    "emailAddress":"Abigail.5fd9918291@testmail.identitysoon.com",
    "id":"2c91808a7e78aabb017e79029b160461",
    "identityStatus":"ACTIVE",
    "isManager":false,
    "lastRefresh":"2022-06-19T16:40:55.055Z",
    "managerRef":{
       "id":"2c91808c7e78aabd017e79029cb9045e",
       "name":"Herbert 2ca592eefa",
       "type":"IDENTITY"
    },
    "modified":"2022-08-09T01:06:10.872Z",
    "name":"Abigail 5fd9918291",
    "processingState":null
 }

Get Identity History

Gets the audit events related to access changes for a specific identity.

Field Description
Identity Select an identity, or enter a JSONPath expression to select the technical ID of an identity. Audit events from the selected identity will be returned.
From Optionally choose a date to return events only on or after that date.
Event Type Optionally enter the type of event to return. These are: AccessItemAssociated, AccessItemRemoved, AttributesChanged, AccessRequested, IdentityCertified, and AccountStatusChanged.
Open "Get Identity History" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
[
    {
        "accessItem":{
            "accessType":"accessProfile",
            "appRefs":[
                {
                    "cloudAppId":"4596769",
                    "cloudAppName":"Access Request App"
                }
            ],
            "description":"Access to entitlement AD Access request",
            "displayName":"Access to entitlement AD Access request",
            "entitlementCount":1,
            "id":"2c9180887ff4d87e017ff5b1192b010e",
            "sourceId":"2c9180857fef847b017ff5aefb7f1723",
            "sourceName":"ODS-AD-Source"
        },
        "accessItemType":"accessProfile",
        "dateTime":"2022-04-04T17:48:47.356Z",
        "dt":"2022-04-04T17:48:47.356Z",
        "eventType":"AccessItemAssociated",
        "governanceEvent":null,
        "identityId":"2c9180827fed4bf5017ff5afb9842b57"
    },
    {
        "accessItem":{
            "accessType":"app",
            "displayName":"Access Request App",
            "id":"4596769",
            "sourceName":null
        },
        "accessItemType":"app",
        "dateTime":"2022-04-04T17:48:47.356Z",
        "dt":"2022-04-04T17:48:47.356Z",
        "eventType":"AccessItemAssociated",
        "governanceEvent":null,
        "identityId":"2c9180827fed4bf5017ff5afb9842b57"
    }
]

This step will time out if it takes longer than 1 minute to complete.

Manage Access

Adds or removes access items on one or more identities.

Note

Revoke requests for individual entitlements are limited to one entitlement per access request.

This step's input must be a list of objects in the same format as is provided by the Get Access step. This includes a JSON body similar to this example:

{
    "accessItems":[
        {
            "id":"technicalID",
            "name":"accessItemName",
            "type":"accessItemType"
        }
    ]
}

When this step is used, the workflow submits a request to the external system to process the access change.

  • If the access item requires an approval process before it's granted or removed, that process begins and the workflow continues as soon as the request has been submitted, without waiting for the request to be granted or denied.
    • If you need to wait for the access request to be decided before the workflow continues, end this workflow and create a new one using the Access Request Decision trigger.
  • If the access item doesn't require approval, the workflow does not wait for confirmation from the source that the access was updated before continuing.
    • If you need to make sure the access is updated on the identity's source account before the workflow continues, add a Wait step after the Manage Access step.
Field Description
Request Type Choose whether to add or remove access.
Identities Select one or more identities from the dropdown list that should receive this access or have it removed. You can also use Choose Variable to choose the technical IDs of the identities using JSONPath.
Access to Manage Select the access items to manage. The input to this step must be a list of access objects in the format listed above. The Get Access step provides this input in the correct format.
Comments Provide a comment about why this access is changing.
If you selected Add Access under Request Type, the Select Duration field will appear. Optionally enter the length of time that the user should have the access and select a unit.

This step will time out if it takes longer than 30 minutes to receive a response from the external system.

A test for this action can be simulated. Refer to the Simulating a Workflow Test documentation for more information.

This action returns a JSON blob when it completes successfully.

Open "Manage Access" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
    "failedAccessRequests":[
        {
            "id":"2c918089759466e10175c2b5486d0b85",
            "name":"Access Profile 1",
            "type":"ACCESS_PROFILE"
        }
    ],
    "successfulAccessRequests":[
        {
            "id":"2c918089759466e10175adadf0d30567",
            "name":"Role 1",
            "type":"ROLE"
        },
        {
            "id":"2c91808c759466e80175adae75720526",
            "name":"Role 2",
            "type":"ROLE"
        },
        {
            "id":"2c918089759466e10175b9236b7b08e0",
            "name":"Access Profile 2",
            "type":"ACCESS_PROFILE"
        },
        {
            "id":"2c918089759466e10175c2b5486d0b85",
            "name":"Access Profile 3",
            "type":"ACCESS_PROFILE"
        }
    ]
}

Manage Accounts

Deletes, disables, enables, or unlocks a source account.

Field Description
Account Action Select an action to take on the selected accounts. Valid options are Delete, Disable, Enable, or Unlock.
Select Accounts Choose one or more accounts to act on. If selecting the IDs of accounts from the Get Accounts step, use the JSONPath $.getAccounts.accounts[*].id. The [*].id must be added to the variable chosen by the Variable Selector.

Note

The Delete option is only applicable to accounts on flat file sources.

This step will time out if it takes longer than 1 hour to complete.

A test for this action can be simulated. Refer to the Simulating a Workflow Test documentation for more information.

This action returns a JSON blob when it completes successfully. The object in this JSON body is the ID of the account that was updated.

Open "Manage Accounts" JSON Sample 
1
2
3
{
    "id":"2c91808474683da6017468693c260195"
 }

Manage ServiceNow Ticket

Creates a new ServiceNow ticket, or returns or updates the status of an existing ticket.

This step will time out if it takes longer than 300 seconds to complete.

Field Description
Authentication Type Select the type of authentication.
Request URL Enter the ServiceNow endpoint's URL.
Action Select the action you want to perform. The options are Create new ticket, Update ticket status, and Get ticket status.
If you selected OAuth 2.0 - Client Credentials Grant under Authentication Type:
Token URL Enter the URL of the token.
Client ID Enter your client ID.
Client Secret Enter your client secret.
ServiceNow Username Enter the username authorized to access ServiceNow.
ServiceNow Password Enter the password corresponding the the username.
Request URL Enter the ServiceNow endpoint's URL.
If you selected Basic Authentication under Authentication Type:
ServiceNow Username Enter the username authorized to access ServiceNow.
ServiceNow Password Enter the password corresponding the the username.
Request URL Enter the ServiceNow endpoint's URL.
If you selected Create new ticket under Action:
Caller Enter the ServiceNow username of the caller.
Watchlist Enter the ServiceNow usernames of users you want to receive notifications about this ticket.
Short Description Enter a short description about the ticket.
Description Add additional details about the ticket.
Category Enter a category for the ticket.
Sub-Category Enter a sub-category for the ticket.
Urgency Select the urgency of the ticket.
Additional Fields Enter any additional fields required by ServiceNow and their values in key:value pairs, separated by line breaks.
If you selected Update ticket status under Action:
Ticket ID Enter the ID of the ticket you want to update.
Status Select the ticket's new status.
If you selected Get ticket status under Action:
Ticket ID Enter the ID of the ticket you want to get the status of.

This action returns a JSON blob when it completes successfully.

Open "ServiceNow" JSON Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
"problem_id":"",
"reassignment_count":"0",
"reopen_count":"0",
"reopened_by":"",
"reopened_time":"",
"resolved_at":"",
"resolved_by":"",
"rfc":"",
"route_reason":"",
"service_offering":"",
"severity":"3",
"short_description":"Ticket created from SP IDN Workflows",
"sla_due":"",
"state":"1",
"subcategory":"email",
"sys_class_name":"incident",
"sys_created_by":"workflows",
"sys_created_on":"2022-09-19 04:52:44",
"sys_domain":{
   "link":"https://ven04069.service-now.com/api/now/table/sys_user_group/global",
   "value":"global"
},
"sys_domain_path":"/",
"sys_id":"5cfdc551db869910349c6ce2ca96192d",
"sys_mod_count":"0",
"sys_tags":"",
"sys_updated_by":"workflows",
"sys_updated_on":"2022-09-19 04:52:44",
"task_effective_number":"INC0010006",
"time_worked":"",
"universal_request":"",
"upon_approval":"proceed",
"upon_reject":"cancel",
"urgency":"3",
"user_input":"",
"watch_list":"",
"work_end":"",
"work_notes":"",
"work_notes_list":"",
"work_start":""
}
},
"headers":null,
"responseTime":"0.476802 seconds",
"statusCode":201
}

Send Email

Sends an email to the specified identity.

Field Required? Description
Recipient Addresses Yes The email address that should receive this email. Select or enter up to 10 email addresses.
Reply-To Address No The email address to use as the reply-to address. If left blank, this uses the "From" address on the Branding page.
From Address No The email address to use as the sender address. If left blank, this uses the "From" address on the Branding page.
Subject No The subject line of the email.
Body No The body of the email.
Templating Context No The map of variables to be passed to the email template. Use the format {"variable1.$":"$.JSONPathVariableSelection1", "variable2.$":"$.JSONPathVariableSelection2"}. The variable in each map can be used to represent the value selected by the JSONPath in the second part of each map and entered in the email template using the format ${variable}.

Templating Context Example

The following example uses JSONPath to select the username of an identity in the Get Identity step and assign it the variable "name":
{"name.$":"$.getIdentity.name"}
To use the username variable within the body of the email, the following can be used in the Body field:
"Your username is ${name}."
In the final rendered email, the identity's username will be displayed in place of the variable.

This step will time out if it takes longer than 1 minute to complete.

Send Slack Message

Sends a direct Slack message to the specified user. If the user is not found in Slack, an email will be sent instead.

Field Required? Description
Recipient Yes The IdentityNow username of the user that should receive the Slack message.
Message Yes The body of the Slack message.

Note

The Slack integration with SailPoint is required. Refer to Getting Started with Slack for SailPoint for more information.

Wait

Pauses the workflow's execution for a set period of time.

Field Required? Description
Type Yes Choose Wait For to configure the step to pause for a time duration or Wait Until to wait until a specific date and time.
If you selected Wait For:
Wait Duration Yes The length of time to pause the workflow. Choose a number and select the time unit. Choose a time period between 60 seconds and 30 days.
If you selected Wait Until:
Future Date Yes The date when this workflow should resume, using the local time zone of the admin creating the workflow. This can be pulled from a variable in the workflow. Choose a date no more than 180 days in the future.
Time Yes The time on the specified date when this workflow should resume. This field only appears when the Type is Wait Until.

This step will time out if it takes longer than 182 days to complete.

To learn more about the process of building a workflow, either in the visual builder or using JSON, visit Creating and Managing Workflows.

Review our lists of triggers and operators that you can use to start and manage your workflow.