Account Correlation API (ACCOUNT_CORRELATION_CONFIG)

[edmarks]

We have a unique use case where we want to extract the Correlation Configuration from a few hundred sources to evaluate changes to assist with uncorrelated accounts. I don’t see an API in the Beta/V3 for this and when turning on developer tools in the browser I see an API call like the following:
https://<org_value>.api.identitynow.com/diana/sources/sources//correlationConfig?_dc=&page=1&start=0&limit=25

I’ve seen similar API calls using both “diana” and “shelby” but when trying to access these from PostMan I’m getting a routing error. The assumption is these are “internal use only” or something specific with the need for the “_dc” value but hoping someone can help clarify.

In the “sources” API call we get back the following which is what we want to call an API to get the additional information for:
“accountCorrelationConfig”: {
“type”: “ACCOUNT_CORRELATION_CONFIG”,
“id”: “”,
“name”: “AD [source] Account Correlation”
},

[Sushantmrj (Sushant Maharjan)]

@edmarks,
For “Unable to route request”, try making an API call by grabbing the accessToken from the UI, i.e. https://orgName/ui/session

[colin_mckibben]

Any route that doesn’t use /cc, /beta, or /v3 are internal only routes. You won’t be able to call them yourself.

I was unable to find a beta or v3 API that returns the account correlation config. The v3 source API will only return the manager correlation config. I’ll talk to engineering about getting the account correlation added to the v3 sources API response.

In the meantime, it looks like you can use a cc API to get the account correlation config. Please note that cc is not a production supported API, and can change without notice. I wouldn’t advise using this in production critical applications.

You will need to find the sourceId used by CC, which is different than v3/beta. One way to get this ID is to check your address bar when inside a source in the UI:

Or, you can call the cc list sources endpoint.

GET https://{tenant}.api.identitynow.com/cc/api/source/list

To get the account correlation config, use this endpoint.

GET https://{tenant}.api.identitynow.com/cc/api/source/get/{sourceId}

This returns a response object that has the account correlation config:

"correlationConfig": {
        "attributeAssignments": [
            {
                "complex": false,
                "filterString": null,
                "ignoreCase": true,
                "matchMode": null,
                "operation": "EQ",
                "property": "identificationNumber",
                "value": "id"
            }
        ],
        "id": "2c918084838b1cc90183a9ced42916c3",
        "name": "Employees [source] Account Correlation"
    },

[aditya_pathak]

GET https://{tenant}.api.identitynow.com/cc/api/source/get/{sourceId}

doesn’t seem to work anymore

[colin_mckibben]

I think your source ID is incorrect. It should be a 5 digit number.

[aditya_pathak]

it’s a 4-digit number in our scenario. I had also tried the long id /external id, but the API still doesn’t work

[colin_mckibben]

Your screenshot is cut off, so I can’t see the rest of the request details. Are you doing a POST or a GET?

[kamil (Kamil Brzakala)]

Hi Colin,
Do you know if there is any public API available to update correlation config?

[colin_mckibben]

Unfortunately no, there isn’t a public API that can update the correlation config. For now, it is an internal only API.

[colin_mckibben]

Actually, I stand corrected. It looks like the SP config API can be used to modify the correlation config. Please see this post for more info. Public API to retrieve correlation rules - #3 by mcheek

There is also an idea to add a new API endpoint for managing the account correlation. Please upvote this. https://ideas.sailpoint.com/ideas/GOV-I-2275