# Account Filter String

**URL:** <https://developer.sailpoint.com/discuss/t/account-filter-string/171704>\
**Category:** SHF Discussion and Questions\
**Tags:** sailpoint-identity-security\
**Created:** [August 20, 2025, 7:56pm UTC](https://developer.sailpoint.com/discuss/t/account-filter-string/171704 "2025-08-20T19:56:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssel](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@ssel](https://developer.sailpoint.com/discuss/u/ssel)\
**Post date:** [August 20, 2025, 7:56pm UTC](https://developer.sailpoint.com/discuss/t/account-filter-string/171704/1 "2025-08-20T19:56:27Z")

</div>

Hi,

I used an account filter string in Authorative source, and it doesn’t work. The requirement is to exclude an account as part of aggregation, below is the one used in connectorAttributes,

“account.filterString”: “(EMPLOYEEID != /“12345/”)”

I ran the unoptimized aggregation but IDN creating it. Please advise

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [August 20, 2025, 11:39pm UTC](https://developer.sailpoint.com/discuss/t/account-filter-string/171704/2 "2025-08-20T23:39:24Z")

</div>

> [@ssel](#):
>
> rString”: “(EMPLOYEEID != /“12345/”)”

What’s source and connector type ?

---

<div class="post-metadata">

**Author:** ![gogubapu](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gogubapu/32/15242_2.png) [@gogubapu](https://developer.sailpoint.com/discuss/u/gogubapu)\
**Post date:** [August 21, 2025, 2:11pm UTC](https://developer.sailpoint.com/discuss/t/account-filter-string/171704/3 "2025-08-21T14:11:12Z")

</div>

Use Below curl to patch filter string to your source:  
`curl --location --request PATCH '`[`https://{{tenant}}.api.identitynow.com/beta/sources/{{sourceId}}'`](https://mckessondev.api.identitynow.com/beta/sources/fb9fbe782ac44c708cd4203a10cc17f1%27 "https://mckessondev.api.identitynow.com/beta/sources/fb9fbe782ac44c708cd4203a10cc17f1%27")` \`  
`--header 'Content-Type: application/json-patch+json' \`  
`--header 'Authorization: Bearer eyJ0eXAiOiJKV1QiLC7G0Y7bM2Xlffq2O897nMcu1tQ7tWwIqd1R65IUhTdgvid6YKI5LUutUx4EbwfrvKJRQGysKgO-fg4Q' \`  
`--data '[`  
` {`  
` "op": "add",`  
` "path": "/connectorAttributes/filterString",`  
` "value": "( EMPLOYEEID != \"12345\" )"`  
` }`  
`]'`

Which connector you’re using as authoritative source?

---

<div class="post-metadata">

**Author:** ![KevinHarrington](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kevinharrington/32/6776_2.png) [@KevinHarrington](https://developer.sailpoint.com/discuss/u/KevinHarrington)\
**Post date:** [August 22, 2025, 3:30pm UTC](https://developer.sailpoint.com/discuss/t/account-filter-string/171704/5 "2025-08-22T15:30:29Z")

</div>

The account.filterString will filter OUT the users that meet your criteria. So if it worked, you’d be removing all accounts that don’t have an EMPLOYEEID of 12345. And your slashes to escape the quotes are backwards.

I think you want something more like:

```auto
"account.filterString": "(EMPLOYEEID == \"12345\")"

```

---

<div class="post-metadata">

**Author:** ![rohit\_wekhande](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/rohit_wekhande/32/28501_2.png) [@rohit\_wekhande](https://developer.sailpoint.com/discuss/u/rohit_wekhande)\
**Post date:** [August 22, 2025, 5:08pm UTC](https://developer.sailpoint.com/discuss/t/account-filter-string/171704/6 "2025-08-22T17:08:37Z")

</div>

Hello,

This is an Exclusion Filter and NOT Inclusion Filter.

If means if your expression is –\> “account.filterString”: “(EMPLOYEEID != /“12345/”)”

then, all accounts whose EMPLOYEEID is not equals to 12345 will be excluded from aggregation by SailPoint ISC tenant.

Regards,

Rohit Wekhande.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [October 21, 2025, 5:09pm UTC](https://developer.sailpoint.com/discuss/t/account-filter-string/171704/7 "2025-10-21T17:09:09Z")

</div>

Closed on October 21, 2025, 5:09pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.