Adding a dynamic approver to my request

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi everyone, I’m trying to build a workflow in order to handle the dynamic approver event trigger that Sailpoint ISC is offering, but I’m facing some issues. First of all I followed this guideto set up the external trigger in the workflow and the event trigger, obviously i used the "dynamic approver " event trigger and not the one mentioned in the guide. Following screens document how it set up the event trigger and the workflow:

event_trigger_settings
event_trigger_settings600×958 20.4 KB

worfklow_1
worfklow_1405×333 5.33 KB

worfklow_2
worfklow_2355×708 12.6 KB

workflow_3
workflow_3373×688 13.5 KB

As you can see the only thing that change from the guide is in the field “Request Body” , I inserted the output expected by the event trigger that I’m using , and I decided , for testing pourposes, to not to insert other approvers, because I want just to test if the workflow and the event trigger work properly. But when I perform an access request for an item i have an error in the request center that says that I have to contact the Help Desk, and in the event trigger i have this error and the request is “in progres” here:

errror
errror498×798 16.6 KB

While if I check the execution status of the workflow I have an error in the execution with these messages:

type,timestamp,attributes
WorkflowExecutionStarted,"2025-03-25T16:38:34.499716107Z","{""input"":{""_metadata"":{""callbackURL"":""https://partner11902.api.identitynow-demo.com/beta/trigger-invocations/2f226686-f5d4-4b04-b685-1197125fd09f/complete"",""responseMode"":""async"",""secret"":""78591cdd-0fc5-4216-86a3-0d21b385ba58"",""triggerId"":""idn:access-request-dynamic-approver"",""triggerType"":""requestResponse""},""accessRequestId"":""4a18660e9a9b41ab90aa06cfab9f481a"",""requestedBy"":{""id"":""991a7a89b20c43528aedd62e5ae2af43"",""name"":""s.tartaglione"",""type"":""IDENTITY""},""requestedFor"":{""id"":""257e9442e16547bda523f6faf265d738"",""name"":""987987987"",""type"":""IDENTITY""},""requestedItems"":[{""assignmentContext"":null,""comment"":null,""description"":""Questo Access Profile ti da il gruppo Entra: TestGroup3"",""id"":""40bb5595af7c4c8f810e3a20f4bce43f"",""name"":""AD Liquid Access Profile Test Group 3"",""operation"":""Add"",""type"":""ACCESS_PROFILE""}]}}"
ActivityTaskScheduled,"2025-03-25T16:38:34.655685309Z","{""displayName"":""HTTP Request"",""input"":{""authenticationType"":null,""basicAuthPassword"":null,""basicAuthUserName"":null,""csvRequestBody"":null,""formRequestBody"":null,""headerAuthName"":null,""headerAuthValue"":null,""jsonRequestBody"":{""id"":"""",""name"":"""",""type"":""""},""method"":""post"",""oAuthClientId"":null,""oAuthClientSecret"":null,""oAuthCredentialLocation"":null,""oAuthScope"":null,""oAuthTokenUrl"":null,""requestContentType"":""json"",""requestHeaders"":null,""textRequestBody"":null,""url"":""https://partner11902.api.identitynow-demo.com/beta/trigger-invocations/2f226686-f5d4-4b04-b685-1197125fd09f/complete"",""urlParams"":null,""xmlRequestBody"":null},""stepName"":""hTTPRequest"",""task"":""sp:http"",""technicalName"":""HTTP Request""}"
ActivityTaskStarted,"2025-03-25T16:38:34.655722264Z","{""attempts"":1,""displayName"":""HTTP Request"",""stepName"":""hTTPRequest"",""task"":""sp:http"",""technicalName"":""HTTP Request""}"
ActivityTaskFailed,"2025-03-25T16:38:34.754001302Z","{""displayName"":""HTTP Request"",""error"":""request failed"",""stepName"":""hTTPRequest"",""task"":""sp:http"",""technicalName"":""HTTP Request""}"
WorkflowExecutionFailed,"2025-03-25T16:38:34.777367535Z","{""error"":""task failed: activity error (type: sp:external:http:v2, scheduledEventID: 5, startedEventID: 6, identity: 1@sp-workflow-worker-internal-68c4567b97-wftbx@sp-workflow-engine): request failed (type: HTTP Response Returned a Client Error, retryable: false): request failed: 403 - 403 Forbidden - {\""messages\"":[{\""localeOrigin\"":\""DEFAULT\"",\""locale\"":\""en-US\"",\""text\"":\""The server understood the request but refuses to authorize it.\""},{\""localeOrigin\"":\""REQUEST\"",\""locale\"":\""en-US\"",\""text\"":\""The server understood the request but refuses to authorize it.\""}],\""trackingId\"":\""d7d2b8d29760473bbb3166afee8d1aaf\"",\""detailCode\"":\""403 Forbidden\""}""}"

Can anyone help me to set up this event trigger with this workflow? Thanks

2

Hi @s_tartaglione you can check the access level of Personal access token you generated and used in this workflow as client_Id and Client_Secret.

3

The request body in your HTTP Request action that responds back to the trigger is missing some information, like the secret that is needed to authenticate. That is why you are seeing a 403 Forbidden in your workflow logs. Try this in your request body:

{
  "secret": "{{$.trigger._metadata.secret}}",
  "output": {
    "id": "",
    "name": "",
    "type": ""
  }
}
1 Like