Skip to content

Workflow Triggers

When building a workflow, you'll always start with a trigger.

A trigger is the event that tells the workflow to start. The workflow uses data provided by the input to calculate the results of each action and operator.

All available triggers are listed below, along with a sample input, if applicable, that can be used to test a workflow.

You can also define filters to limit when a trigger fires, such as limiting the Source Account Created trigger to only begin the workflow when the account was created on a specific source.

Access Request Decision

An access request was approved or denied.

This trigger only fires if you have the Access Request service.

Open "Access Request Decision" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
    "accessRequestId":"4b4d982dddff4267ab12f0f1e72b5a6d",
    "requestedBy":{
        "id":"2c91808b6ef1d43e016efba0ce470906",
        "name":"Adam Admin",
        "type":"IDENTITY"
    },
    "requestedFor":{
        "id":"2c91808b6ef1d43e016efba0ce470909",
        "name":"Ed Engineer",
        "type":"IDENTITY"
    },
    "requestedItemsStatus":[
        {
            "approvalInfo":[
                {
                    "approvalComment":" this is an approval comment",
                    "approvalDecision":"APPROVED",
                    "approver":{
                        "id":"2c91808b6ef1d43d016efba0cf470910",
                        "name":"Stephen Austin",
                        "type":"IDENTITY"
                    },
                    "approverName":"Stephen.Austin"
                }
            ],
            "clientMetadata":{
                "applicationName":"My application"
            },
            "comment":"requester comments",
            "description":"Engineering Access",
            "id":"2a91808b6cf1d43e016efba0cf470904",
            "name":"Engineering Access",
            "operation":"Add",
            "type":"ACCESS_PROFILE"
        }
    ]
}

Notes

  • clientMetadata is determined by the user that invoked create-access-request and can contain any value at runtime that was specified in the access request.
  • When multiple approval decisions are required, the trigger fires after the final decision when it is known whether the access item was approved or denied for the user.

Access Request Submitted

An access request with an attached workflow linked in the Approval Type was submitted. The Access Request Submitted trigger will only fire if the access item is requested and the Workflow is enabled.

Editing, deleting, or disabling a workflow using this trigger will impact future access requests. Access requests currently being reviewed will continue through the review process as previously configured.

This trigger only fires if you have the Access Request service.

Open "Access Request Submitted" JSON Input Sample 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
{
    "tenantId" : "9e386a4e-2e84-46e3-92c0-5728fb6bbf80",
    "org" : "org1",
    "pod": "pod1",
    "requestId" : "8e386a4e-2e84-46e3-92c0-5728fb6bbf80",
    "workflowId": "bcb35791-bac0-4a6a-8079-45c2703ddf7f",
    "parentWorkflowExecutionId": "4b4d982dddff4267ab12f0f1e72b5a6d",
    "workflowExecutionId": "platform-workflow-2861f3d3-f605-4364-908c-33e13027f307",
    "accessRequestId": "4b4d982dddff4267ab12f0f1e72b5a6d",
    "accountActivityId": "1b4d982dddff4267ab12f0f1e72b5a6t",
    "requestedItem": {
      "id": "489265de20a447d4bac99897d6a5b4e8",
      "name": "Engineering Access",
      "description": "Engineering Access",
      "type": "ACCESS_PROFILE",
      "operation": "Add",
      "addDate": "2009-11-10T23:00:00Z",
      "removeDate": "2009-11-10T23:00:00Z",
      "reauthRequired": true,
      "comment": {
        "author": {
          "identityID": "identityID",
          "name": "comment author name"
        },
        "comment": "test comment"
      },
      "assignmentContext": {
        "accessRequestContext": {
          "contextAttributes": [
            {
              "attribute": "department",
              "value": "Engineering",
              "derived": false
            },
            {
              "attribute": "displayName",
              "value": [
                "John"
              ],
              "derived": false
            }
          ]
        },
        "matchedRoles": [
          {
            "roleRef": {
              "type": "DIMENSION",
              "id": "2c91808b6ef1d43e016efba0ce470904",
              "name": "India country"
            },
            "matchedAttributes": [
              {
                "attribute": "displayName",
                "value": [
                  "John"
                ],
                "derived": false
              }
            ]
          }
        ],
        "computedDate": "2024-03-28T16:17:01.324148Z"
      },
      "requestedAccounts": [
        {
          "sourceId": "1b4d982dddff4267ab12f0f1e72b5a6t",
          "accounts": [
            {
              "accountUuid": "1b4d982dddff4267ab12f0f1e72b5a6t",
              "nativeIdentity": "1b4d982dddff4267ab12f0f1e72b5a6t"
            },
            {
              "accountUuid": "1b4d982dddff4267ab12f0f1e72b5a6y",
              "nativeIdentity": "1b4d982dddff4267ab12f0f1e72b5a6t"
            }
          ]
        },
        {
          "sourceId": "1b4d982dddff4267ab12f0f1e72b5a6y",
          "accounts": [
            {
              "accountUuid": "1b4d982dddff4267ab12f0f1e72b5a6t",
              "nativeIdentity": "1b4d982dddff4267ab12f0f1e72b5a6t"
            },
            {
              "accountUuid": "1b4d982dddff4267ab12f0f1e72b5a6y",
              "nativeIdentity": "1b4d982dddff4267ab12f0f1e72b5a6t"
            }
          ]
        }
      ]
    },
    "requestedBy": {
      "id": "ff1e0d8d7b07483c9c3b4d8fdfb19811",
      "name": "Adam Admin",
      "type": "IDENTITY"
    },
    "requestedFor": {
      "id": "898be4dcbcb54ea78430b03885cb533d",
      "name": "annie",
      "type": "IDENTITY"
    },
    "sod": {
      "violated": "true",
      "details": {}
    },
    "ipaddress": "",
    "countryRaisedfrom": "",
    "requestedAt": "2009-11-10T23:00:00Z"
  }

Account Aggregation Completed

An account aggregation completed, was terminated by the SailPoint system, or failed.

Open "Account Aggregation Completed" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
{
    "source":{
        "id":"4e4d982afddff4267ab12f0f1e72b5e6d",
        "name":"Corporate Active Directory",
        "type":"SOURCE"
    },
    "status":"Success",
    "started":"2020-06-29T22:01:50.474Z",
    "completed":"2020-06-29T22:02:04.090Z",
    "errors":[

    ],
    "warnings":[
        "Account skipped"
    ],
    "stats":{
        "scanned":200,
        "unchanged":190,
        "changed":6,
        "added":4,
        "removed":3
    }
}

Account Inactivity Detected

An account with a set number of consecutive days of inactivity has been detected.

Field Description
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.

The filtering for this trigger is based on configuring the set number of consecutive days in the trigger filter. Below are some example trigger filters.

To trigger after 180 consecutive days of inactivity:

$[?(@.trigger.daysInactive > 180)]

For the trigger to only look at the filtered source:

$[?(@.sourceID)]

Open "Account Inactivity Detected" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
{
   "name":"Notification on Account Inactivity ",
   "description":"A workflow that delivers a custom notification to recipients that an account has been inactive for a period of time.",
   "modified":"2025-10-27T17:18:47.166862457Z",
   "modifiedBy":{
      "type":"IDENTITY",
      "id":"5f8123eb53384a14b6f4036006346848",
      "name":"aaron.nichols"
   },
   "definition":{
      "start":"Send Email",
      "steps":{
         "End Step - Success":{
            "actionId":"sp:operator-success",
            "displayName":"",
            "type":"success"
         },
         "Send Email":{
            "actionId":"sp:send-email",
            "attributes":{
               "body":"<p>Hello Admin,</p>\n<p>This email is to inform you that account ID ${accountId} of ${identityID} has been inactive for ${inactivity} consecutive days.</p>",
               "context":{
                  "accountId.$":"$.trigger.accountID",
                  "identityId.$":"$.trigger.identityID",
                  "inactivity.$":"$.trigger.daysInactive"
               },
               "recipientEmailList":[
                  "Aaron.Nichols@sailpointdemo.com"
               ],
               "subject":"Inactive Account Detected"
            },
            "displayName":"",
            "nextStep":"End Step - Success",
            "type":"action",
            "versionNumber":2
         }
      }
   },
   "creator":{
      "type":"IDENTITY",
      "id":"5f8123eb53384a14b6f4036006346848",
      "name":"aaron.nichols"
   },
   "trigger":{
      "type":"EVENT",
      "attributes":{
         "id":"adi:account-inactivity-detected"
      }
   }
}

Account Triggers

Account Created

This event trigger fires when a new account is created on a source or in Identity Security Cloud.

Accounts can be created via aggregations or provisioning, including when entitlements are added or removed.

You could use this event trigger to fire a Workflow that you configure to notify a source owner when an account is created.

Field Description
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.
Open "Account Created" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
  "event": {
    "type": "ACCOUNT_CREATED_V2",
    "cause": "AGGREGATION"
  },
  "source": {
    "id": "jlasdferquwoep452343214v",
    "name": "Active Directory",
    "alias": "AD",
    "owner": {
      "id": "owner-123",
      "name": "Source Owner"
    },
    "governanceGroup": {
      "id": "group-456",
      "name": "Governance Group"
    }
  },
  "account": {
    "id": "ee769173319b41d19ccec35ba52f237b",
    "name": "john.doe",
    "nativeIdentity": "john.doe",
    "uuid": "b7264868-7201-415f-9118-b581d431c688",
    "correlated": true,
    "isMachine": false,
    "origin": "Active Directory",
    "attributes": {
      "firstname": "John",
      "lastname": "Doe",
      "email": "john.doe@gmail.com",
      "department": "Sales",
      "displayName": "John Doe",
      "created": "2020-04-27T16:48:33.597Z",
      "employeeNumber": "E009",
      "uid": "E009",
      "inactive": "true",
      "phone": "512-555-1234",
      "manager": "jane.doe",
      "identificationNumber": "E009"
    }
  },
  "identity": {
    "id": "132rfvwfr14353yas56213l",
    "name": "john.doe",
    "alias": "jdoe",
    "email": "john.doe@gmail.com"
  }
}

Account Deleted

This event trigger fires when an account is deleted from a source or from Identity Security Cloud.

Accounts can be deleted via aggregations or provisioning.

You could use this event trigger to fire a Workflow that you configure to take additional actions after a privileged account has been deleted.

Field Description
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.
Open "Account Deleted" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
  "event": {
    "type": "ACCOUNT_DELETED_V2",
    "cause": "AGGREGATION"
  },
  "source": {
    "id": "jlasdferquwoep452343214v",
    "name": "Active Directory",
    "alias": "AD",
    "owner": {
      "id": "owner-123",
      "name": "Source Owner"
    },
    "governanceGroup": {
      "id": "group-456",
      "name": "Governance Group"
    }
  },
  "account": {
    "id": "ee769173319b41d19ccec35ba52f237b",
    "name": "john.doe",
    "nativeIdentity": "john.doe",
    "uuid": "b7264868-7201-415f-9118-b581d431c688",
    "correlated": true,
    "isMachine": false,
    "origin": "Active Directory",
    "attributes": {
      "firstname": "John",
      "lastname": "Doe",
      "email": "john.doe@gmail.com",
      "department": "Sales",
      "displayName": "John Doe",
      "created": "2020-04-27T16:48:33.597Z",
      "employeeNumber": "E009",
      "uid": "E009",
      "inactive": "true",
      "phone": "512-555-1234",
      "manager": "jane.doe",
      "identificationNumber": "E009"
    }
  },
  "identity": {
    "id": "132rfvwfr14353yas56213l",
    "name": "john.doe",
    "alias": "jdoe",
    "email": "john.doe@gmail.com"
  }
}

Account Updated

This event trigger fires when an account is updated on a source or an Identity Security Cloud account.

Accounts can be updated via aggregations or provisioning, including when entitlements are added or removed.

You could use this event trigger to fire a Workflow that you configure to take additional actions after a new entitlement has been provisioned to a privileged account.

Field Description
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.
Open "Account Updated" JSON Input Sample 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
{
  "event": {
    "type": "ACCOUNT_UPDATED_V2",
    "cause": "AGGREGATION"
  },
  "source": {
    "id": "source-001",
    "name": "Active Directory",
    "alias": "AD",
    "owner": {
      "id": "owner-123",
      "name": "Source Owner"
    },
    "governanceGroup": {
      "id": "group-456",
      "name": "Governance Group"
    }
  },
  "account": {
    "id": "acc-789",
    "name": "john.doe",
    "nativeIdentity": "CN=John Doe,OU=Users,DC=acme,DC=com",
    "uuid": "b7264868-7201-415f-9118-b581d431c688",
    "correlated": true,
    "isMachine": false,
    "origin": "Active Directory",
    "attributes": {
      "created": "2020-04-27T16:48:33.597Z",
      "updated": "2024-06-10T12:00:00Z",
      "department": "Sales",
      "displayName": "John Doe",
      "email": "john.doe@gmail.com",
      "employeeNumber": "E009",
      "firstname": "John",
      "identificationNumber": "ID12345",
      "inactive": "false",
      "lastname": "Doe",
      "manager": "jane.doe",
      "phone": "512-555-1234",
      "uid": "john.doe",
      "passwordLastSet": 1748199531418,
      "telephoneNumber": "512-555-1234",
      "pager": "555-0000",
      "mail": "john.doe@gmail.com",
      "sAMAccountName": "john.doe",
      "msNPAllowDialin": "true",
      "givenName": "John",
      "objectClass": [
        "user",
        "person"
      ],
      "distinguishedName": "CN=John Doe,OU=Users,DC=acme,DC=com",
      "cn": "John Doe",
      "objectType": "User",
      "accountFlags": [
        "512"
      ],
      "NetBIOSName": "ACME",
      "objectguid": "b7264868-7201-415f-9118-b581d431c688",
      "primaryGroupID": "513",
      "objectSid": "S-1-5-21-1234567890-123456789-1234567890-1001",
      "memberOf": [
        "CN=Sales,OU=Groups,DC=acme,DC=com"
      ],
      "sn": "Doe",
      "msDS-PrincipalName": "john.doe@acme.com",
      "idNowDescription": "AD User",
      "pwdLastSet": "2024-06-10T12:00:00Z"
    }
  },
  "identity": {
    "id": "id-321",
    "name": "john.doe",
    "alias": "jdoe",
    "email": "john.doe@gmail.com"
  },
  "accountChangeTypes": [
    "ATTRIBUTES_CHANGED",
    "ENTITLEMENTS_ADDED"
  ],
  "singleValueAttributeChanges": [
    {
      "name": "sn",
      "oldValue": null,
      "newValue": "Doe"
    },
    {
      "name": "email",
      "oldValue": "john.old@acme.com",
      "newValue": "john.doe@gmail.com"
    }
  ],
  "multiValueAttributeChanges": [
    {
      "name": "memberOf",
      "addedValues": [
        "CN=Sales,OU=Groups,DC=acme,DC=com"
      ],
      "removedValues": [
        "CN=Marketing,OU=Groups,DC=acme,DC=com"
      ]
    }
  ],
  "entitlementChanges": [
    {
      "attributeName": "groups",
      "added": [
        {
          "id": "ent-001",
          "value": "User",
          "name": "User group",
          "owner": {
            "id": "id-321",
            "name": "John Doe",
            "type": "IDENTITY"
          }
        }
      ],
      "removed": [
        {
          "id": "ent-002",
          "value": "Admin",
          "name": "Admin group",
          "owner": {
            "id": "id-322",
            "name": "Jane Doe",
            "type": "IDENTITY"
          }
        }
      ]
    }
  ]
}

Accounts Collected for Aggregation

Identity Security Cloud has gathered the accounts on a source and is prepared to aggregate them.

Open "Accounts Collected for Aggregation" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
    "source":{
        "id":"4e4d982dbdff4267ab16f0f1e72b5c6d",
        "name":"Corporate Active Directory",
        "type":"SOURCE"
    },
    "status":"Success",
    "started":"2020-06-29T22:01:50.474Z",
    "completed":"2020-06-29T22:02:04.090Z",
    "errors":[
    ],
    "warnings":[
        "Account skipped"
    ],
    "stats":{
        "scanned":200,
        "unchanged":190,
        "changed":6,
        "added":4,
        "removed":3
    }
}

Certification Triggers

Workflow triggers related to parts of a certification.

Campaign Activated

A certification campaign was activated.

This trigger only fires if you have the Certifications service.

Open "Campaign Activated" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
{
    "campaign":{
        "id":"2c91848576f886190176e88cac6a0010",
        "name":"Manager Access Campaign",
        "description":"Audit access for all employees.",
        "created":"2021-02-16T03:04:45.815Z",
        "modified":null,
        "deadline":"2021-03-16T03:04:45.815Z",
        "type":"MANAGER",
        "campaignOwner":{
            "id":"37f081867702e1910177031820c40n27",
            "displayName":"William Wilson",
            "email":"william.wilson@example.com"
        },
        "status":"ACTIVE"
    }
}

Campaign Ended

A certification campaign ended.

This trigger only fires if you have the Certifications service.

Open "Campaign Ended" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
{
    "campaign":{
        "id":"2c91808576f846190176f81cac5a0810",
        "name":"Manager Access Campaign",
        "description":"Audit access for all employees.",
        "created":"2021-02-16T03:04:45.815Z",
        "modified":null,
        "deadline":"2021-03-16T03:04:45.815Z",
        "type":"MANAGER",
        "campaignOwner":{
            "id":"37f080867705c1910177031220c40e27",
            "displayName":"William Wilson",
            "email":"william.wilson@example.com"
        },
        "status":"COMPLETED"
    }
}

Campaign Generated

A certification campaign finished generating.

This trigger only fires if you have the Certifications service.

Open "Campaign Generated" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
{
    "campaign":{
        "id":"2c91834576f886190176f88efc5a0010",
        "name":"Manager Access Campaign",
        "description":"Audit access for all employees.",
        "created":"2021-02-16T03:04:45.815Z",
        "modified":null,
        "deadline":null,
        "type":"MANAGER",
        "campaignOwner":{
            "id":"37f082867702c1910177031320c60n27",
            "displayName":"William Wilson",
            "email":"william.wilson@example.com"
        },
        "status":"STAGED"
    }
}

Certification Signed Off

A certification reviewer signed off on their certifications.

This trigger only fires if you have the Certifications service.

Open "Certification Signed Off" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
{
    "certification":{
        "id":"2c91208574f836190176b88caf0d0167",
        "name":"Manager Access Review for Alice Baker",
        "created":"2020-02-16T03:04:45.815Z",
        "modified":null,
        "campaignRef":{
            "campaignType":"MANAGER",
            "description":"Audit access for all employees.",
            "type":"CAMPAIGN",
            "id":"2c91808576f896190176f38cac5c0010",
            "name":"Manager Access Campaign"
        },
        "completed":true,
        "hasErrors":false,
        "errorMessage":null,
        "decisionsMade":50,
        "decisionsTotal":50,
        "due":"2020-03-16T03:04:45.815Z",
        "signed":"2020-03-04T03:04:45.815Z",
        "reviewer":{
            "name":"Reviewers group",
            "id":"6a80321c-8d11-40bc-a3c8-29e2660b85e8",
            "type":"GOVERNANCE_GROUP",
            "email":null
        },
        "campaignOwner":{
            "id":"37f081867702c1910179031320c40n27",
            "displayName":"William Wilson",
            "email":"william.wilson@example.com"
        },
        "reassignment":{
            "comment":"Changing reviewer.",
            "from":{
                "id":"8a89c6de77ef762f0177ef7f52f10004",
                "name":"Manger Access Review for Charlie Davis",
                "type":"CERTIFICATION",
                "reviewer":{
                    "id":"2c9180867702c1910177031320c4010c",
                    "name":"Charlie Davis",
                    "type":"IDENTITY",
                    "email":"charlie.davis@example.com"
                }
            }
        },
        "phase":"SIGNED",
        "entitiesCompleted":12,
        "entitiesTotal":12
    }
}

DAS Activity Alert

An alert was created by an activity on a DAS application.

Open "DAS Activity Alert" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
{
    "appId": 1,
    "appTypeId": 1,
    "appName": "SharePoint Online",
    "timestamp": "2024-07-08T09:17:26.0000000Z",
    "userName": "chris.wilford@acme.com",
    "userFullName": "chris.wilford@acme.com",
    "objectName": "employees.xlsx",
    "objectType": "File",
    "path": "https://acme.sharepoint.com/sites/HR/Shared Documents/Eng",
    "actionType": "File Downloaded",
    "fileExtension": "xlsx",
    "ipAddress": "185.208.199.1",
    "dcPolicies": [
       "PII"
    ],
    "dcRules": [
       "SSN",
       "Phone Numbers"
    ],
    "dcCategories": [
       "SSN",
       "Phone Number"
    ],
    "alertRuleNames": [
       "Rule name 1",
       "Rule name 2"
    ],
    "alertRuleSeverities": [
       "High",
       "Medium"
    ],
     "identityId": "ceecd993991045778b72382f103458e9",
    "identityEmail": "chris.wilford@acme.com",
    "identityStatus": "UNREGISTERED",
    "identityFirstName": "Chris",
    "identityLastName": "Wilford",
    "identityManager": "Bobby Ray",
    "identityProfile": "Admin",
    "identityCountry": "Texas",
    "identityLocation": "US",
    "identityJobTitle": "Support Engineer",
    "identityDepartment": "IT",
    "customAttribute1": null,
    "customAttribute2": "custom value"
}

Device Compliance Change

A device compliance change CAEP Event was received.

Field Description
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.

The filtering for this trigger is based on capturing the URL in the trigger filter. Below is an example of a trigger filter:

$.ssfEvent.events["https://schemas.openid.net/secevent/caep/event-type/device-compliance-change"][?(@.current_status == "not-compliant")]

This trigger only fires if you have the Shared Signals Framework service.

Open "Device Compliance Change" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
{
    "pk": "<tenant_id>#<identity_id>",
    "correlatedID": {
        "format": "email",
        "email": "someuser@somedomain.com"
    },
    "identityAttributes": {
        "identityID": "1ba9e70786fc410b855adf1e385ccfd0",
        "name": "Donald Duck",
        "alias": "donald.duck",
        "type": null,
        "state": "ACTIVE",
        "inactive": false,
        "protected": false,
        "disabled": false,
        "correlated": true,
        "created": "1970-01-20T12:03:06.898893-07:00",
        "modified": "1970-01-20T19:46:54.115674-07:00"
    },
    "ssfEvent": {
        "iss": "https://idp.example.com/123456789/",
        "jti": "24c63fb56e5a2d77a6b512616ca9fa24",
        "iat": 1615305159,
        "aud": "https://sp.example.com/caep",
        "txn": 8675309,
        "sub_id": {
            "format": "complex",
            "user": {
                "format": "email",
                "email": "user@example.com"
            },
            "device": {
                "format": "opaque",
                "sub": "11112222333344445555"
            }
        },
        "events": {
            "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change": {
                "current_status": "not-compliant",
                "previous_status": "compliant",
                "initiating_entity": "policy",
                "reason_admin": {
                    "en": "Location Policy Violation: C076E8A3"
                },
                "reason_user": {
                    "en": "Device is no longer in a trusted location."
                },
                "event_timestamp": 1615304991643
            }
        }
    }
}

External Trigger

A third-party system triggered a workflow based on configurations made on that system and within your SaaS platform.

Because the input provided to the workflow by the external trigger varies depending on the external site and API, it's not possible to use the variable selector in future steps to choose variables from this trigger.

However, you can still select variables using JSONPath for use in future steps by adding the trigger field to your JSONPath expression using the Goessner implementation.

For example, if your external system provides the following input to your workflow when the trigger is fired:

{
    "name":"Sherri",
    "email":"sherri@email.com"
}

You can use the following JSONPath expression to select the value of the name field in a future action:

$.trigger.name

To use an external trigger, you must generate an access token using the information provided in the trigger. You can find an overview of generating an access token below.

Generating an Access Token for an External Trigger

After adding an External Trigger to your workflow:

  1. Select New Access Token.

  2. Copy the Client ID, Client URL, and the Client Secret to a secure location and save them. The Client Secret can't be retrieved once this page is closed.

  3. Use the contents of the text field under Generate OAuth Token to create an OAuth 2.0 token so that your external system can authenticate into your SaaS platform and trigger your workflow.

  4. Use the contents of the text box under Provide Workflow Input to configure your external system to correctly trigger your workflow. Replace the {"sampleJSON":"sampleJSON"} object with the input you want to use in your workflow.

Once you've completed these steps or saved this information in a secure location, you can close the overlay and continue building your workflow.

If you lose the access token for this step and need to generate a new one, you can select this step and choose New Access Token. The previous token will be overwritten.

Form Submitted

A form was submitted by a user.

This trigger fires when a form is submitted or when a form is submitted with specific attribute values.

To use a Form Submitted trigger, complete the following fields:

Field Description
Description Enter a description of the trigger.
Basic/Advanced Choose whether to use the Basic or Advanced configuration options. Basic allows configuration of a trigger using one form. Advanced allows you to use JSONPath to filter when a trigger fires based on multiple forms, form elements, or values within a form.
If you selected Basic:
Form to Filter Select which form to use to trigger the workflow.
Form Element to Filter Select the technical key of the element you want to filter for, limiting the conditions under which this trigger starts the workflow.
Operator Select an operator to act on the selected form element. The available operators will change based on your selection.
Attribute Value Enter the value that should appear in the field you selected. When the submitted form meets these criteria, the workflow is triggered.
If you selected Advanced:
Filter A JSONPath expression to narrow down the circumstances under which your workflow will be triggered.

Example Filters:

  • Trigger the workflow when the selected form is submitted and the department equals sales AND the manager equals amanda.ross.

    $[?(@.formDefinitionId == '<formId\>' && @.formData.department == "sales" && @.formData.manager == "amanda.ross")]

  • Trigger the workflow when the selected form is submitted and either the department equals sales OR finance.

    $[?(@.formDefinitionId == '<formId>' && (@.formData.department == "sales" || @.formData.department == "finance"))]

  • Trigger the workflow when either of the selected forms is submitted.

    $[?(@.formDefinitionId == '<formId1>' || @.formDefinitionId == '<formId2>' )]

Below is an example of the JSON for this trigger.

Note

The data inside “formData” is dynamic and will depend on the selected form.

Open "Form Submitted" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
    "exampleInput":{
       "submittedAt":"2020-06-29T22:01:50.474Z",
       "tenantId":"2c9180845f1edece015d27s9717c3e19",
       "formInstanceId":"2c9180835d2e5167015d32f890ca1482",
       "formDefinitionId":"2c9180845d2e5168015j32f890ca1581",
       "name":"Open Service Request",
       "createdBy":{
          "type":"WORKFLOW_EXECUTION",
          "id":"2c9180843d1edece015d27a9617c3e19"
       },
       "submittedBy":{
          "type":"IDENTITY",
          "id":"2v9180845d1edece015r27a9717c3e19",
          "name":"“John “Doe"
       },
       "formData":{
          "department":"IT",
          "requestType":"New Laptop",
          "laptop":"New Laptop type for Engineer",
          "comments":"My laptop is running slow, and I need to get a new laptop to get my work done. Thanks!"
       }
    }
 }

Identity Triggers

Changes made to identities and their attributes.

Identity Attributes Changed

One or more attributes was changed on an identity.

To use an identity attributes changed trigger, complete the following fields:

Field Description
Description Enter a description of the trigger.
Basic/Advanced Choose whether to use the Basic or Advanced configuration options. Basic allows configuration of a trigger using one attribute. Advanced allows you to use JSONPath to filter when a trigger fires based on multiple attributes.
If you selected Basic:
Attribute to Filter Select the technical key of the attribute you want to filter for, limiting the conditions under which this trigger starts the workflow.
If you selected Advanced:
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.
Open "Identity Attributes Changed" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
    "identity":{
        "id":"ee769173319b41d19ccec6cea52f237b",
        "name":"john.doe",
        "type":"IDENTITY"
    },
    "changes":[
        {
            "attribute":"department",
            "oldValue":"sales",
            "newValue":"marketing"
        },
        {
            "attribute":"manager",
            "oldValue":{
                "id":"ee769173319b41d19ccec6c235423237b",
                "name":"william.wilson",
                "type":"IDENTITY"
            },
            "newValue":{
                "id":"ee769173319b41d19ccec6c235423236c",
                "name":"ed.engineer",
                "type":"IDENTITY"
            }
        },
        {
            "attribute":"email",
            "oldValue":"john.doe@hotmail.com",
            "newValue":"john.doe@gmail.com"
        }
    ]
}

Identity Created

An identity was created.

To use an identity created trigger, complete the following fields:

Field Description
Description Enter a description of the trigger.
Basic/Advanced Choose whether to use the Basic or Advanced configuration options. Basic allows configuration of a trigger using one attribute. Advanced allows you to use JSONPath to filter when a trigger fires based on multiple attributes.
If you selected Basic:
Attribute to Filter Select the technical key of the attribute you want to filter for, limiting the conditions under which this trigger starts the workflow.
Operator Select an operator to act on the selected attribute. The available operators will change based on your selection.
Attribute Value Enter the value that should appear in the field you selected. When a new identity is created with an attribute that meets this criteria, the workflow is triggered.
If you selected Advanced:
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.
Open "Identity Created" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
    "identity":{
        "id":"ee769173319b41d19ccec6cea52f237b",
        "name":"john.doe",
        "type":"IDENTITY"
    },
    "attributes":{
        "firstname":"John",
        "lastname":"Doe",
        "email":"john.doe@gmail.com",
        "department":"Sales",
        "displayName":"John Doe",
        "created":"2020-04-27T16:48:33.597Z",
        "employeeNumber":"E009",
        "uid":"E009",
        "inactive":"true",
        "phone":null,
        "identificationNumber":"E009",
        "isManager":false,
        "manager":{
            "id":"ee769173319b41d19ccec6c235423237b",
            "name":"william.wilson",
            "type":"IDENTITY"
        },
        "customAttribute1":"customValue",
        "customAttribute2":"customValue2"
    }
}

Identity Deleted

An identity was deleted from Identity Security Cloud. Note that this does not mean that the user no longer has accounts on any sources, only that their accounts do not correlate to an identity.

Open "Identity Deleted" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
{
    "identity":{
        "id":"ee769173319b41d19ccec6cea52f237b",
        "name":"john.doe",
        "type":"IDENTITY"
    },
    "attributes":{
        "firstname":"John",
        "lastname":"Doe",
        "email":"john.doe@gmail.com",
        "department":"Sales",
        "displayName":"John Doe",
        "created":"2020-04-27T16:48:33.597Z",
        "employeeNumber":"E009",
        "uid":"E009",
        "inactive":"true",
        "phone":null,
        "identificationNumber":"E009",
        "isManager":false,
        "manager":{
            "id":"ee769173319b41d19ccec6c235423237b",
            "name":"william.wilson",
            "type":"IDENTITY"
        },
        "customAttribute1":"customValue",
        "customAttribute2":"customValue2"
    }
}

Identity Lifecycle State Changed

An identity's cloudLifecycleState attribute has changed.

Open "Identity Lifecycle State Changed" JSON Input Sample 
1
2
3
4
5
6
7
8
9
{
  "identity": {
    "id": "ee769173319b41d19ccec6cea52f237b",
    "name": "john.doe",
    "type": "IDENTITY"
  },
  "oldLifecycleState": "preHire",
  "newLifecycleState": "active"
}

Identity Lifecycle State Change Processed

An identity lifecycle state change was processed after the system evaluated and applied configured actions, even if no access changes were made.

Open "Identity Lifecycle State Change Processed" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "identity": {
    "id": "identity-id",
    "name": "identity-name",
    "email": "identity-email@example.com",
    "authoritativeSource": {
      "id": "source-id",
      "name": "source-name",
      "sourceType": "source-type"
    }
  },
  "manager": {
    "id": "manager-id",
    "name": "manager-name",
    "email": "manager-email@example.com"
  },
  "previousState": {
    "name": "previous-state-name"
  },
  "newState": {
    "name": "new-state-name"
  },
  "changeDetails": {
    "isManual": true,
    "actor": {
      "id": "actor-id",
      "name": "actor-name",
      "email": "actor-email@example.com"
    },
    "process": "process-name"
  }
}

Interactive Trigger

A user launched an Interactive Process.

This trigger only fires when the Launchers associated with this trigger are manually initiated by a user from the Launchpad.

You can use the search query LAUNCHER_LAUNCHED to view details of launched interactive processes. Details include the Actor (the user that launched the interactive process), Target (the name of the launcher), and when the interactive process was launched.

Field Description
Create Launcher Select Create Launcher to create a Launcher that shares a name and description with the current workflow. An entitlement is automatically created for this Launcher.

After your workflow has been configured, you can change the Launcher associated with this trigger from the Launchers page.
Open "Interactive Trigger" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
{
    "config": {
      "config": {},
      "workflowId": "cff0c7c3-9be3-4bde-a976-fa716fa4e1b9"
    },
    "interactiveProcessId": "01JF7TP9K9EGRNHEGCN091ZE3Z",
    "launchedAt": "2024-12-16T13:32:00.503937587Z",
    "launchedBy": {
      "id": "1f937e2dd3334ddca917130eab27a162",
      "type": "IDENTITY"
    },
    "workflowId": "cff0c7c3-9be3-4bde-a976-fa716fa4e1b9"
}

Machine Identity Triggers

Machine Identity Created

This event trigger fires when a new machine identity is created in Identity Security Cloud.

Machine identities can be created via the UI, endpoint, or aggregations. Machine identities can also be created via machine account mappings.

Field Description
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.

You could use this event trigger to fire a Workflow that you configure to discover machine identity owners when a machine identity is created.

Customers that have licensed Machine Identity Security or Agent Identity Security will receive this event trigger.

Open "Machine Identity Created" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
{
  "eventType": "MACHINE_IDENTITY_CREATED",
  "machineIdentity": {
    "id": "8cd6c945-0057-4a6e-ad65-9cbf3b3c71b6",
    "name": "TestName",
    "created": "2025-08-08T12:42:21.491666Z",
    "modified": "2025-09-01T06:36:54.401476Z",
    "businessApplication": "MyBusinessApplication2",
    "description": "test description event",
    "attributes": {
      "status": "Inactive",
      "botUserId": "005KV00000BLoMCYA1",
      "createdAt": "2025-09-01T10:23:23.000+0000",
      "createdById": "0053k00000Am6MQAAZ",
      "systemModstamp": "2025-09-18T09:34:40.000+0000",
      "apiFriendlyName": "Agentforce_Service_Agent_90"
    },
    "subtype": "AI Agent",
    "owners": [
      {
        "type": "IDENTITY",
        "id": "84d8c1b819144608b8b8bc3b84ddbb7b",
        "name": "Jerrie admin3cf084",
        "isPrimary": true
      },
      {
        "type": "IDENTITY",
        "id": "b6c1506f7eaa48dbbe6bffab65aacb9e",
        "name": "Lorilee srcadm9d33",
        "isPrimary": false
      }
    ],
    "sourceId": "c0201251a6ce4d268aba536cdd60a7f2",
    "uuid": "f5dd23fe-3414-42b7-bb1c-869400ad7a10",
    "nativeIdentity": "abc:123:dddd1",
    "manuallyEdited": true,
    "manuallyCreated": true,
    "datasetId": "agentforce:agents",
    "source": {
      "type": "SOURCE",
      "id": "c0201251a6ce4d268aba536cdd60a7f2",
      "name": "IdentityNow"
    },
    "userEntitlements": [
      {
        "sourceId": "7443d0ffb1304bbcbdf4c07b5c09d4f2",
        "entitlementId": "2509f650c20a3ab5956be70f6f136fbc",
        "displayName": "CN=Engineering-test-org3,OU=megapod-useast1-test-org3,OU=org-data-service,DC=TestAutomationAD,DC=local",
        "source": {
          "type": "SOURCE",
          "id": "7443d0ffb1304bbcbdf4c07b5c09d4f2",
          "name": "ODS-AD-Source"
        }
      }
    ],
    "existsOnSource": "NOT_APPLICABLE"
  }
}

Machine Identity Deleted

This event trigger fires when a machine identity is deleted in Identity Security Cloud.

Machine identities can be deleted via the UI, endpoint, or aggregations. Machine identities can also be auto-deleted when all account correlations to the machine identity are removed.

Field Description
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.

You could use this event trigger to fire a Workflow that you configure to notify machine identity owners when a machine identity is decommissioned.

Customers that have licensed Machine Identity Security or Agent Identity Security will receive this event trigger.

Open "Machine Identity Deleted" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
{
  "eventType": "MACHINE_IDENTITY_DELETED",
  "machineIdentity": {
    "id": "8cd6c945-0057-4a6e-ad65-9cbf3b3c71b6",
    "name": "TestName",
    "created": "2025-08-08T12:42:21.491666Z",
    "modified": "2025-09-01T06:36:54.401476Z",
    "businessApplication": "MyBusinessApplication2",
    "description": "test description event",
    "attributes": {
      "status": "Inactive",
      "botUserId": "005KV00000BLoMCYA1",
      "createdAt": "2025-09-01T10:23:23.000+0000",
      "createdById": "0053k00000Am6MQAAZ",
      "systemModstamp": "2025-09-18T09:34:40.000+0000",
      "apiFriendlyName": "Agentforce_Service_Agent_90"
    },
    "subtype": "AI Agent",
    "owners": [
      {
        "type": "IDENTITY",
        "id": "84d8c1b819144608b8b8bc3b84ddbb7b",
        "name": "Jerrie admin3cf084",
        "isPrimary": true
      },
      {
        "type": "IDENTITY",
        "id": "b6c1506f7eaa48dbbe6bffab65aacb9e",
        "name": "Lorilee srcadm9d33",
        "isPrimary": false
      }
    ],
    "sourceId": "c0201251a6ce4d268aba536cdd60a7f2",
    "uuid": "f5dd23fe-3414-42b7-bb1c-869400ad7a10",
    "nativeIdentity": "abc:123:dddd1",
    "manuallyEdited": true,
    "manuallyCreated": true,
    "datasetId": "agentforce:agents",
    "source": {
      "type": "SOURCE",
      "id": "c0201251a6ce4d268aba536cdd60a7f2",
      "name": "IdentityNow"
    },
    "userEntitlements": [
      {
        "sourceId": "7443d0ffb1304bbcbdf4c07b5c09d4f2",
        "entitlementId": "2509f650c20a3ab5956be70f6f136fbc",
        "displayName": "CN=Engineering-test-org3,OU=megapod-useast1-test-org3,OU=org-data-service,DC=TestAutomationAD,DC=local",
        "source": {
          "type": "SOURCE",
          "id": "7443d0ffb1304bbcbdf4c07b5c09d4f2",
          "name": "ODS-AD-Source"
        }
      }
    ],
    "existsOnSource": "NOT_APPLICABLE"
  }
}

Machine Identity Updated

This event trigger fires when a machine identity is updated in Identity Security Cloud.

Machine identities can be updated via the UI, endpoint, or aggregations.

Field Description
Filter Enter a JSONPath expression to narrow down the circumstances under which your workflow will be triggered.

You could use this event trigger to fire a Workflow that you configure to notify machine identity owners when a machine identity's owner list changes.

Customers that have licensed Machine Identity Security or Agent Identity Security will receive this event trigger.

Open "Machine Identity Updated" JSON Input Sample 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
{
  "eventType": "MACHINE_IDENTITY_UPDATED",
  "machineIdentity": {
    "id": "8cd6c945-0057-4a6e-ad65-9cbf3b3c71b6",
    "name": "test",
    "created": "2025-08-08T12:42:21.491666Z",
    "modified": "2025-09-01T06:36:54.401476Z",
    "businessApplication": "MyBusinessApplication2",
    "description": "test description event",
    "attributes": {
      "status": "Inactive",
      "botUserId": "005KV00000BLoMCYA1",
      "createdAt": "2025-09-01T10:23:23.000+0000",
      "createdById": "0053k00000Am6MQAAZ",
      "systemModstamp": "2025-09-18T09:34:40.000+0000",
      "apiFriendlyName": "Agentforce_Service_Agent_90"
    },
    "subtype": "AI Agent",
    "owners": [
      {
        "type": "IDENTITY",
        "id": "84d8c1b819144608b8b8bc3b84ddbb7b",
        "name": "Jerrie admin3cf084",
        "isPrimary": true
      },
      {
        "type": "IDENTITY",
        "id": "b6c1506f7eaa48dbbe6bffab65aacb9e",
        "name": "Lorilee srcadm9d33",
        "isPrimary": false
      }
    ],
    "sourceId": "c0201251a6ce4d268aba536cdd60a7f2",
    "uuid": "f5dd23fe-3414-42b7-bb1c-869400ad7a10",
    "nativeIdentity": "abc:123:dddd1",
    "manuallyEdited": true,
    "manuallyCreated": true,
    "datasetId": "agentforce:agents",
    "source": {
      "type": "SOURCE",
      "id": "c0201251a6ce4d268aba536cdd60a7f2",
      "name": "IdentityNow"
    },
    "userEntitlements": [
      {
        "sourceId": "7443d0ffb1304bbcbdf4c07b5c09d4f2",
        "entitlementId": "2509f650c20a3ab5956be70f6f136fbc",
        "displayName": "CN=Engineering-test-org3,OU=megapod-useast1-test-org3,OU=org-data-service,DC=TestAutomationAD,DC=local",
        "source": {
          "type": "SOURCE",
          "id": "7443d0ffb1304bbcbdf4c07b5c09d4f2",
          "name": "ODS-AD-Source"
        }
      }
    ],
    "existsOnSource": "NOT_APPLICABLE"
  },
  "machineIdentityChangeTypes": [
    "ATTRIBUTES_CHANGED",
    "USER_ENTITLEMENTS_ADDED",
    "USER_ENTITLEMENTS_REMOVED",
    "OWNERS_ADDED",
    "OWNERS_REMOVED"
  ],
  "userEntitlementChanges": {
    "attributeName": "userEntitlements",
    "added": [
      {
        "sourceId": "7443d0ffb1304bbcbdf4c07b5c09d4f2",
        "entitlementId": "2509f650c20a3ab5956be70f6f136fbc",
        "displayName": "CN=Engineering-test-org3,OU=megapod-useast1-test-org3,OU=org-data-service,DC=TestAutomationAD,DC=local",
        "source": {
          "type": "SOURCE",
          "id": "7443d0ffb1304bbcbdf4c07b5c09d4f2",
          "name": "ODS-AD-Source"
        }
      }
    ],
    "removed": [
      {
        "sourceId": "c0201251a6ce4d268aba536cdd60a7f2",
        "entitlementId": "22c17d66217133369e0dedd93989d7b5",
        "displayName": "Config Hub Read Only",
        "source": {
          "type": "SOURCE",
          "id": "c0201251a6ce4d268aba536cdd60a7f2",
          "name": "IdentityNow"
        }
      }
    ]
  },
  "ownerChanges": {
    "attributeName": "owners",
    "added": [
      {
        "type": "IDENTITY",
        "id": "b6c1506f7eaa48dbbe6bffab65aacb9e",
        "name": "Lorilee srcadm9d33",
        "isPrimary": false
      }
    ],
    "removed": []
  },
  "singleValueAttributeChanges": [
    {
      "name": "description",
      "oldValue": "Old description",
      "newValue": "test description event"
    }
  ]
}

Native Change Account Triggers

Changes made to accounts external to Identity Security Cloud.

Native Change Account Created

A new account external to Identity Security Cloud was created. Note you must have at least one source configured for Native Change Detection (NCD) before you will receive events from this trigger.

Open "Native Change Account Created" JSON Input Sample 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
{
    "identity": {
        "manager": {
          "name": "Martena Heath",
          "id": "2c91808378eb9fa30178fb8caf90097f",
          "type": "IDENTITY",
          "email": "martena.heath@sample_email.com"
        },
        "name": "peter.williams",
        "alias": "peter.williams",
        "id": "e43ba47b265b4baf943efe3aaef886c8",
        "type": "IDENTITY",
        "email": "peter.williams@sample_email.com"
    },
    "singleValueAttributeChanges": [
        {
            "newValue": "Peter Williams",
            "name": "cn",
            "oldValue": null
        },
        {
            "newValue": "Peter Williams",
            "name": "displayName",
            "oldValue": null
        },
        {
            "newValue": "CN=Peter Williams,OU=Austin,OU=Americas,OU=Demo,DC=seri,DC=sailpointdemo,DC=com",
            "name": "distinguishedName",
            "oldValue": null
        },
        {
            "newValue": "Peter",
            "name": "givenName",
            "oldValue": null
        }
    ],
    "entitlementChanges": [
        {
            "removed": [],
            "added": [
                {
                    "owner": {
                      "id": "2c91808978eb9fab0178fb8ca9280919",
                      "name": "Gregory Brooks",
                      "type": "IDENTITY"
                    },
                    "name": "ProductionManagement",
                    "id": "2c91808778eb9fa30178fb9482f00c60",
                    "value": "CN=ProductionManagement,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
                },
                {
                    "owner": null,
                    "name": "Employees",
                    "id": "2c91808378eb9fa30178fb94818e0af8",
                    "value": "CN=Employees,OU=BirthRight,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
                },
                {
                    "owner": null,
                    "name": "WindowsAdministration",
                    "id": "2c91808378eb9fa30178fb9481c30b02",
                    "value": "CN=WindowsAdministration,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
                }
            ],
            "attributeName": "memberOf"
        }
    ],
    "eventType": "ACCOUNT_CREATED",
    "source": {
        "owner": {
            "name": "Aaron Andrew",
            "id": "2c9180867a7c46d0017a7ca099d50531",
            "type": "IDENTITY",
            "email": "aaron.andrew@sample_email.com"
        },
        "name": "Active Directory",
        "alias": "Active Directory [source]",
        "id": "2c91808a78efc63e0178fb8624b248c5",
        "type": "SOURCE",
        "governanceGroup": {
          "id": "fd0d1393-35fb-47d8-9809-0e385b73f25e",
          "name": "Active Directory Owners",
          "type": "GOVERNANCE_GROUP"
        }
    },
    "accountChangeTypes": [
        "ATTRIBUTES_CHANGED",
        "ENTITLEMENTS_ADDED"
    ],
    "multiValueAttributeChanges": [
        {
            "removedValues": [],
            "addedValues": [
                "top",
                "person",
                "organizationalPerson",
                "user"
            ],
            "name": "objectClass"
        },
        {
            "removedValues": [],
            "addedValues": [
                "Normal User Account",
                "Password Cannot Expire",
                "User Account is Disabled"
            ],
            "name": "accountFlags"
        }
    ],
    "account": {
        "name": "peter.williams",
        "id": "b3b17b0072f04da39b41e8802aaff01b",
        "type": "ACCOUNT",
        "uuid": "{615ebfa6-3d21-484e-9e67-01bd4e20c3da}",
        "correlated": true,
        "nativeIdentity": "CN=Peter Williams,OU=Austin,OU=Americas,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
    }
}

Native Change Account Deleted

An account external to Identity Security Cloud was deleted. Note you must have at least one source configured for Native Change Detection (NCD) before you will receive events from this trigger.

Open "Native Change Account Deleted" JSON Input Sample 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
{
    "identity": {
        "manager": {
            "name": "Martena Heath",
            "id": "2c91808378eb9fa30178fb8caf90097f",
            "type": "IDENTITY",
            "email": "martena.heath@sample_email.com"
        },
        "name": "Letty Wilson",
        "alias": "Letty.Wilson",
        "id": "2c91808978eb9fab0178fb8ca6d308fb",
        "type": "IDENTITY",
        "email": "letty.wilson@sample_email.com"
    },
    "singleValueAttributeChanges": [{
            "newValue": null,
            "name": "cn",
            "oldValue": "Letty Wilson"
        },
        {
            "newValue": null,
            "name": "displayName",
            "oldValue": "Letty Wilson"
        },
        {
            "newValue": null,
            "name": "distinguishedName",
            "oldValue": "CN=Letty Wilson,OU=Austin,OU=Americas,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
        }
    ],
    "entitlementChanges": [{
        "removed": [{
                "owner": {
                    "id": "2c91808978eb9fab0178fb8ca9280919",
                    "name": "Gregory Brooks",
                    "type": "IDENTITY"
                },
                "name": "ProductionManagement",
                "id": "2c91808778eb9fa30178fb9482f00c60",
                "value": "CN=ProductionManagement,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
            },
            {
                "owner": null,
                "name": "Employees",
                "id": "2c91808378eb9fa30178fb94818e0af8",
                "value": "CN=Employees,OU=BirthRight,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
            },
            {
                "owner": null,
                "name": "WindowsAdministration",
                "id": "2c91808378eb9fa30178fb9481c30b02",
                "value": "CN=WindowsAdministration,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
            }
        ],
        "added": [],
        "attributeName": "memberOf"
    }],
    "eventType": "ACCOUNT_DELETED",
    "source": {
        "owner": {
            "name": "Aaron Andrew",
            "id": "2c9180867a7c46d0017a7ca099d50531",
            "type": "IDENTITY",
            "email": "aaron.andrew@sample_email.com"
        },
        "name": "Active Directory",
        "alias": "Active Directory [source]",
        "id": "2c91808a78efc63e0178fb8624b248c5",
        "type": "SOURCE",
        "governanceGroup": {
            "id": "fd0d1393-35fb-47d8-9809-0e385b73f25e",
            "name": "Active Directory Owners",
            "type": "GOVERNANCE_GROUP"
        }
    },
    "accountChangeTypes": [
        "ATTRIBUTES_CHANGED",
        "ENTITLEMENTS_REMOVED"
    ],
    "multiValueAttributeChanges": [{
            "removedValues": [
                "top",
                "person",
                "organizationalPerson",
                "user"
            ],
            "addedValues": [],
            "name": "objectClass"
        },
        {
            "removedValues": [
                "Normal User Account",
                "Password Cannot Expire",
                "User Account is Disabled"
            ],
            "addedValues": [],
            "name": "accountFlags"
        }
    ],
    "account": {
        "name": "letty.wilson",
        "id": "6805a47c09cc4dfca9083f1ce84552ee",
        "type": "ACCOUNT",
        "uuid": "{3c096158-9188-46f4-bb13-20ef9daafa7f}",
        "correlated": true,
        "nativeIdentity": "CN=Letty Wilson,OU=Austin,OU=Americas,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
    }
}

Native Change Account Updated

An account external to Identity Security Cloud was updated. Note you must have at least one source configured for Native Change Detection (NCD) before you will receive events from this trigger.

Open "Native Change Account Updated" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
{
    "identity": {
        "manager": {
            "name": "Martena Heath",
            "id": "2c91808378eb9fa30178fb8caf90097f",
            "type": "IDENTITY",
            "email": "martena.heath@sample_email.com"
        },
        "name": "Ann English",
        "alias": "Ann.English",
        "id": "2c91808978eb9fab0178fb8ca6d308fb",
        "type": "IDENTITY",
        "email": "ann.english@sample_email.com"
    },
    "singleValueAttributeChanges": [{
        "newValue": "Call Center Representative",
        "name": "title",
        "oldValue": "Call Center Manager"
    }],
    "entitlementChanges": [{
        "removed": [{
            "owner": null,
            "name": "AccountsReceivable",
            "id": "d0470502d73d4c2e8c7543c712f518ca",
            "value": "CN=AccountsReceivable,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
        }],
        "added": [{
            "owner": null,
            "name": "Accounts Payable",
            "id": "2c91808978eb9fab0178fb9482620b71",
            "value": "CN=AccountsPayable,OU=Groups,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
        }],
        "attributeName": "memberOf"
    }],
    "eventType": "ACCOUNT_UPDATED",
    "source": {
        "owner": {
            "name": "Aaron Andrew",
            "id": "2c9180867a7c46d0017a7ca099d50531",
            "type": "IDENTITY",
            "email": "aaron.andrew@sample_email.com"
        },
        "name": "Active Directory",
        "alias": "Active Directory [source]",
        "id": "2c91808a78efc63e0178fb8624b248c5",
        "type": "SOURCE",
        "governanceGroup": {
            "id": "fd0d1393-35fb-47d8-9809-0e385b73f25e",
            "name": "Active Directory Owners",
            "type": "GOVERNANCE_GROUP"
        }
    },
    "accountChangeTypes": [
        "ATTRIBUTES_CHANGED",
        "ENTITLEMENTS_ADDED",
        "ENTITLEMENTS_REMOVED"
    ],
    "multiValueAttributeChanges": [{
        "removedValues": [],
        "addedValues": [
            "User Account is Disabled"
        ],
        "name": "accountFlags"
    }],
    "account": {
        "name": "Ann.English",
        "id": "2c91808378eb9fa30178fb9481a30afa",
        "type": "ACCOUNT",
        "uuid": "{08ee6c6d-7d02-4978-9417-d92ba6a5ed50}",
        "correlated": true,
        "nativeIdentity": "CN=Ann English,OU=Call Center,OU=AI,OU=Demo,DC=seri,DC=sailpointdemo,DC=com"
    }
}

Outlier Detected

An outlier was detected using Data Intelligence.

Open "Outlier Detected" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
{
    "score":0.9601614,
    "_meta":{
        "triggerType":"FIRE_AND_FORGET",
        "subscriptionId":"e5fa2a32-3f33-436d-bac8-af4c53122eed",
        "invocationId":"b246f3c8-e706-4cfa-9254-360fc6de0ef1"
    },
    "outlierType":"LOW_SIMILARITY",
    "identity":{
        "id":"2c9139527c99d847017cd57f4b586e97",
        "displayName":"Haley Cline",
        "type":"IDENTITY"
    }
}

Provisioning Completed

A provisioning action completed on a source.

This trigger only fires if you have the Provisioning service.

Open "Provisioning Completed" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
{
    "trackingNumber":"4b4d982dddff4267ab12f0f1e72b5a6d",
    "action":"IdentityRefresh",
    "requester":{
        "id":"2c91808b6ef1d43e016efba0ce470906",
        "name":"Adam Admin",
        "type":"IDENTITY"
    },
    "recipient":{
        "id":"2c91808b6ef1d43e016efba0ce470909",
        "name":"Ed Engineer",
        "type":"IDENTITY"
    },
    "errors":[
        "General Error",
        "Connector AD Failed"
    ],
    "warnings":[
        "Notification Skipped due to invalid email"
    ],
    "sources":"Corp AD, Corp LDAP, Corp Salesforce",
    "accountRequests":[
        {
            "source":{
                "id":"4e4d982dddff4267ab12f0f1e72b5a6d",
                "name":"Corporate Active Directory",
                "type":"SOURCE"
            },
            "accountId":"CN=example,ou=sample,ou=test,dc=ex,dc=com",
            "accountOperation":"Modify",
            "provisioningResult":"committed",
            "provisioningTarget":"Corp AD",
            "ticketId":"72619262",
            "attributeRequests":[
                {
                    "operation":"Add",
                    "attributeName":"memberOf",
                    "attributeValue":"CN=admin,DC=training,DC=com"
                }
            ]
        }
    ]
}

A scheduled search completed and results are available.

Open "Scheduled Search" JSON Input Sample 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
{
    "fileName":"Modified.zip",
    "ownerEmail":"test@sailpoint.com",
    "ownerName":"Cloud Support",
    "query":"modified:[now-7y/d TO now]",
    "searchName":"Modified Activity",
    "searchResults":{
        "Identity":{
            "count":"2",
            "noun":"identities",
            "preview":[
                [
                    "Display Name",
                    "First Name",
                    "Last Name",
                    "Work Email",
                    "Created",
                    "Lifecycle State"
                ],
                [
                    "William Wilson",
                    "William",
                    "Wilson",
                    "william.wilson@sailpoint.com",
                    "2019-11-14T15:56:00.862Z",
                    ""
                ],
                [
                    "Ed Engineer",
                    "Ed",
                    "Engineer",
                    "ed.engineer@sailpoint.com",
                    "2019-11-14T15:56:00.862Z",
                    ""
                ]
            ]
        },
        "Entitlement":{
            "count":"2",
            "noun":"entitlements",
            "preview":[
                [
                    "Display Name",
                    "Name",
                    "Description",
                    "Source ID",
                    "Source Name",
                    "Attribute",
                    "Value",
                    "Privileged",
                    "Tags"
                ],
                [
                    "Administrator",
                    "Administrator",
                    "Full administrative access to IdentityNow",
                    "2c91808a6e236e33016e6a91f61e3b32",
                    "IdentityNow",
                    "assignedGroups",
                    "ORG_ADMIN",
                    "false",
                    ""
                ],
                [
                    "Auditor",
                    "Auditor",
                    "Auditor access to IdentityNow",
                    "2c91808a6e236e33016e6a91f61e3b32",
                    "IdentityNow",
                    "assignedGroups",
                    "AUDITOR",
                    "false",
                    ""
                ]
            ]
        },
        "Account":{
            "count":"3",
            "noun":"accounts",
            "preview":[
                [
                    "Account Name",
                    "Native Account ID",
                    "Source Name",
                    "Identity Name",
                    "Extended Attributes",
                    "Tags"
                ],
                [
                    "Adam.Archer",
                    "Adam.Archer",
                    "Engineering",
                    "Adam.Archer",
                    "mail=adam.archer@sample.com,teletexTerminalIdentifier=teletexTerminalIdentifier,postalCode=78726,carLicense=[carLicense],telexNumber=telexNumber,employeeNumber=681497,postOfficeBox=postOfficeBox,registeredAddress=registeredAddress,pager=pager,msRTCSIP-UserEnabled=false,mailNickname=mailNickname,LyncPinSet=LyncPinSet,physicalDeliveryOfficeName=abc,sAMAccountName=Adam.Archer,initials=HH,msNPAllowDialin=msNPAllowDialin,givenName=Adam,homePhone=512-942-7578,objectClass=[objectClass],destinationIndicator=destinationIndicator,postalAddress=postalAddress,internationaliSDNNumber=internationaliSDNNumber,departmentNumber=Legal,objectSid=objectSid,LyncPinLockedOut=LyncPinLockedOut,pwdLastSet=pwdLastSet,msNPCallingStationID=[msNPCallingStationID],msRADIUSFramedIPAddress=msRADIUSFramedIPAddress,preferredLanguage=preferredLanguage,roomNumber=roomNumber,telephoneNumber=512-942-7578,displayName=Adam Archer,distinguishedName=DN=Adam Archer,title=title,seeAlso=seeAlso,uid=uid,secretary=secretary,street=street,objectguid=125,memberOf=[Diagnostics],msExchHideFromAddressLists=false,sn=Archer,department=department,userPrincipalName=userPrincipalName,idNowDescription=391ff9c367aa90a0e1a0c6c174aa1d3dec1d3071148e0e62827858a562397224,st=st,manager=CN=Amanda.Ross,ou=[ou],mobile=512-942-7578,primaryGroupDN=primaryGroupDN,cn=Adam.Archer,facsimileTelephoneNumber=[512-942-7578],l=l,homeMDB=homeMDB,homePostalAddress=11305 Four Points Blvd,SipAddress=SipAddress,o=o,accountFlags=[accountFlags],employeeType=Full Time,preferredDeliveryMethod=preferredDeliveryMethod,primaryGroupID=primaryGroupID,businessCategory=Legal,RegistrarPool=RegistrarPool,msDS-PrincipalName=msDS-PrincipalName,msRADIUSFramedRoute=[msRADIUSFramedRoute],msRADIUSCallbackNumber=msRADIUSCallbackNumber",
                    ""
                ],
                [
                    "Amanda.Ross",
                    "Amanda.Ross",
                    "Engineering",
                    "Amanda.Ross",
                    "mail=amanda.ross@sailpoint.com,teletexTerminalIdentifier=teletexTerminalIdentifier,postalCode=78726,carLicense=[carLicense],telexNumber=telexNumber,employeeNumber=681497,postOfficeBox=postOfficeBox,registeredAddress=registeredAddress,pager=pager,msRTCSIP-UserEnabled=false,mailNickname=mailNickname,LyncPinSet=LyncPinSet,physicalDeliveryOfficeName=abc,sAMAccountName=Amanda.Ross,initials=HH,msNPAllowDialin=msNPAllowDialin,givenName=Amanda,homePhone=512-942-7578,objectClass=[objectClass],destinationIndicator=destinationIndicator,postalAddress=postalAddress,internationaliSDNNumber=internationaliSDNNumber,departmentNumber=Administration,objectSid=objectSid,LyncPinLockedOut=LyncPinLockedOut,pwdLastSet=pwdLastSet,msNPCallingStationID=[msNPCallingStationID],msRADIUSFramedIPAddress=msRADIUSFramedIPAddress,preferredLanguage=preferredLanguage,roomNumber=roomNumber,telephoneNumber=512-942-7578,displayName=Amanda Ross,distinguishedName=DN=Amanda Ross,title=title,seeAlso=seeAlso,uid=uid,secretary=secretary,street=street,objectguid=125,memberOf=[Administration],msExchHideFromAddressLists=false,sn=Ross,department=department,userPrincipalName=userPrincipalName,idNowDescription=0fb7bb4cb6c086640ef098f5dd36c5c42500e3a60a116ea936f284a4f70cf45b,st=st,manager=CN=Amanda.Ross,ou=[ou],mobile=512-942-7578,primaryGroupDN=primaryGroupDN,cn=Amanda.Ross,facsimileTelephoneNumber=[512-942-7578],l=l,homeMDB=homeMDB,homePostalAddress=11305 Four Points Blvd,SipAddress=SipAddress,o=o,accountFlags=[accountFlags],employeeType=Full Time,preferredDeliveryMethod=preferredDeliveryMethod,primaryGroupID=primaryGroupID,businessCategory=Administration,RegistrarPool=RegistrarPool,msDS-PrincipalName=msDS-PrincipalName,msRADIUSFramedRoute=[msRADIUSFramedRoute],msRADIUSCallbackNumber=msRADIUSCallbackNumber",
                    ""
                ],
                [
                    "Amy.Chen",
                    "Amy.Chen",
                    "Engineering",
                    "Amy.Chen",
                    "mail=amy.chen@example.com,teletexTerminalIdentifier=teletexTerminalIdentifier,postalCode=78726,carLicense=[carLicense],telexNumber=telexNumber,employeeNumber=681497,postOfficeBox=postOfficeBox,registeredAddress=registeredAddress,pager=pager,msRTCSIP-UserEnabled=false,mailNickname=mailNickname,LyncPinSet=LyncPinSet,physicalDeliveryOfficeName=abc,sAMAccountName=Amy.Chen,initials=HH,msNPAllowDialin=msNPAllowDialin,givenName=Amy,homePhone=512-942-7578,objectClass=[objectClass],destinationIndicator=destinationIndicator,postalAddress=postalAddress,internationaliSDNNumber=internationaliSDNNumber,departmentNumber=Diagnostics,objectSid=objectSid,LyncPinLockedOut=LyncPinLockedOut,pwdLastSet=pwdLastSet,msNPCallingStationID=[msNPCallingStationID],msRADIUSFramedIPAddress=msRADIUSFramedIPAddress,preferredLanguage=preferredLanguage,roomNumber=roomNumber,telephoneNumber=512-942-7578,displayName=Amy Chen,distinguishedName=DN=Amy Chen,title=title,seeAlso=seeAlso,uid=uid,secretary=secretary,street=street,objectguid=125,memberOf=[Diagnostics],msExchHideFromAddressLists=false,sn=Chen,department=department,userPrincipalName=userPrincipalName,idNowDescription=820ff29573b916d9630205e4cae9a21061284a2866981433c9ef012f644ea326,st=st,manager=CN=William.Wilson,ou=[ou],mobile=512-942-7578,primaryGroupDN=primaryGroupDN,cn=Amy.Chen,facsimileTelephoneNumber=[512-942-7578],l=l,homeMDB=homeMDB,homePostalAddress=11305 Four Points Blvd,SipAddress=SipAddress,o=o,accountFlags=[accountFlags],employeeType=Full Time,preferredDeliveryMethod=preferredDeliveryMethod,primaryGroupID=primaryGroupID,businessCategory=Diagnostics,RegistrarPool=RegistrarPool,msDS-PrincipalName=msDS-PrincipalName,msRADIUSFramedRoute=[msRADIUSFramedRoute],msRADIUSCallbackNumber=msRADIUSCallbackNumber",
                    ""
                ]
            ]
        }
    },
    "signedS3Url":"https://sptcbu-org-data-useast1.s3.amazonaws.com/arsenal-john/reports/Events%20Export.2020-05-06%2018%2759%20GMT.3e580592-86e4-4953-8aea-49e6ef20a086.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20200506T185919Z&X-Amz-SignedHeaders=host&X-Amz-Expires=899&X-Amz-Credential=AKIAV5E54XOGTS4Q4L7A%2F20200506%2Fus-east-1%2Fs3%2Raws4_request&X-Amz-Signature=2e753bb97a12a1fd8a215613e3b82fcdae8ba1fb6a25916843ab5m51d2ddefbc"
}

Scheduled Trigger

A scheduled trigger was initiated based on the configured CRON schedule.

To use a scheduled trigger, complete the following fields:

Field Description
Frequency Set a regular schedule for the trigger to fire, based on a CRON expression. Choose between Daily, Weekly, Monthly, Yearly, or Cron Schedule.
Time Zone Use the dropdowns to select your time zone.

To set the Frequency of the scheduled trigger, choose from the following options:

Field Description
If you selected Daily:
Times Select one or more times for the workflow to start each day.
If you selected Weekly:
Days Select one or more days each week to start the workflow.
Times Select one or more times to start this workflow each day. The workflow will start on each selected time for all days selected.
For Monthly or Yearly, if you selected a Schedule Type of By Date:
Months Select one or more months for the workflow to start. This is for Yearly only.
Days Select one or more dates of the month for the workflow to start.
Times Choose one or more times that this workflow should start each day. The workflow will start on each selected time for all days selected.
For Monthly or Yearly, if you selected a Schedule Type of Relative dates:
Months Select one or more months for the workflow to start. This is for Yearly only.
Dates Select one or more relative dates for the workflow to start for the selected months.
Times Choose one or more times that this workflow should start each day. The workflow will start on each selected time for all days selected.
If you selected Cron Schedule:
Cron String Enter the CRON expression for the schedule your workflow should follow.

NOTE: Cron strings support down to hours only, minutes are not currently supported.

A preview of the workflow schedule displays at the bottom of the configuration panel and updates as you make your selections.

The input for the scheduled trigger is a CRON expression and isn't represented in JSON.

Note

Dependent upon the configured schedule, additional workflow executions may be initiated before previous executions have completed.

Source Triggers

Triggers related to sources and their accounts.

Source Created

A new source was successfully created.

Open "Source Created" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
{
    "id":"2c9180866166b5b0016167c32ef31a66",
    "name":"Test source",
    "type":"DIRECT_CONNECT",
    "created":"2021-03-29T22:01:50.474Z",
    "connector":"active-directory",
    "actor":{
        "id":"ee769173319b41d19ccec6cea52f237b",
        "name":"john.doe",
        "type":"IDENTITY"
    }
}

Source Deleted

A source was successfully deleted.

Open "Source Deleted" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
{
    "id":"2c9180866166b5b0016167c32ef31a66",
    "name":"Test source",
    "type":"DIRECT_CONNECT",
    "deleted":"2021-03-29T22:01:50.474Z",
    "connector":"active-directory",
    "actor":{
        "id":"ee769173319b41d19ccec6cea52f237b",
        "name":"john.doe",
        "type":"IDENTITY"
    }
}

Source Updated

Configuration changes were successfully made to a source.

Open "Source Updated" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
{
    "id":"2c9180866166b5b0016167c32ef31a66",
    "name":"Test source",
    "type":"DIRECT_CONNECT",
    "modified":"2021-03-29T22:01:50.474Z",
    "connector":"active-directory",
    "actor":{
        "id":"ee769173319b41d19ccec6cea52f237b",
        "name":"john.doe",
        "type":"IDENTITY"
    }
}

VA Cluster Status Change Event

A virtual appliance cluster changed status.

Open "VA Cluster Status Change Event" JSON Input Sample 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
{
    "created":"2020-06-29T22:01:50.474Z",
    "type":"Source",
    "application":{
        "id":"2c9180866166b5b0016167c32ef31a66",
        "name":"Production VA Cluster",
        "attributes":{
            "clusterId":"2c9180866166b5b0016167c32ef31a66"
        }
    },
    "healthCheckResult":{
        "status":"Failed",
        "resultType":"SOURCE_STATE_FAILURE_SOURCE",
        "message":" Test Connection failed with exception.  Error message - java.lang.Exception"
    },
    "previousHealthCheckResult":{
        "status":"Failed",
        "resultType":"SOURCE_STATE_HEALTHY",
        "message":"Source is healthy."
    }
}

To learn more about the process of building a workflow, either in the visual builder or using JSON, visit Building Workflows.

Once you've selected a trigger for your workflow, you can add actions and operators.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.