# Aggregate entitlement information from different endpoint and populate on accounts - Web Services Connector

**URL:** <https://developer.sailpoint.com/discuss/t/aggregate-entitlement-information-from-different-endpoint-and-populate-on-accounts-web-services-connector/37790>\
**Category:** SHF Discussion and Questions\
**Tags:** webservice-connector, entitlements, aggregation, sailpoint-identity-security\
**Created:** [March 26, 2024, 9:22am UTC](https://developer.sailpoint.com/discuss/t/aggregate-entitlement-information-from-different-endpoint-and-populate-on-accounts-web-services-connector/37790 "2024-03-26T09:22:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arshad](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@Arshad](https://developer.sailpoint.com/discuss/u/Arshad)\
**Post date:** [March 26, 2024, 9:22am UTC](https://developer.sailpoint.com/discuss/t/aggregate-entitlement-information-from-different-endpoint-and-populate-on-accounts-web-services-connector/37790/1 "2024-03-26T09:22:50Z")

</div>

Hi Everyone,

I have a **Web Services** based target application for which I need to configure aggregation and provisioning. First, I need to implement “Account Aggregation” configuration for the same. The problem I’m facing here is that `/Users` endpoint only gives the user information and not the groups information. For getting the groups info, there is different endpoint altogether called `/Groups`.

I cannot use parent-child operation chaining here as well because the /Groups endpoint does not support filtering based on user. For example it does not support `/Groups/test_user` where it should ideally give out the groups present on the user. Rather, what it only supports it `/Groups/<group id>` which would only return the group in their system and their respective group members.

> Note: This target system is not fully SCIM compliant and the problem with groups not being part of the user response is causing issues with SCIM connectors as well. Hence implementing this via webservices.

Providing sample API responses below:

- /Users

```auto
{
    "totalResults": 4,
    "startIndex": 1,
    "itemsPerPage": 4,
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "Resources": [
        {
            "emails": [
                {
                    "type": "work",
                    "value": "iam.user2@test.com",
                    "primary": true
                }
            ],
            "displayName": "user2 iam",
            "name": {
                "familyName": "iam",
                "givenName": "user2"
            },
            "active": true,
            "id": "1410384382554223",
            "userName": "iam.user2@test.com"
        },
        {
            "emails": [
                {
                    "type": "work",
                    "value": "iam.user1@test.com",
                    "primary": true
                }
            ],
            "displayName": "iam user1",
            "name": {
                "familyName": "user1",
                "givenName": "iam"
            },
            "active": false,
            "id": "4212450687312103",
            "userName": "iam.user1@test.com"
        }
    ]
}

```

- /Groups

```auto
{
    "totalResults": 2,
    "startIndex": 1,
    "itemsPerPage": 2,
    "schemas": [
        "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
    "Resources": [
        {
            "displayName": "account users",
            "members": [
                {
                    "display": "user2 iam",
                    "value": "1410384382554223",
                    "$ref": "Users/1410384382554223"
                },
                {
                    "display": "iam user1",
                    "value": "4212450687312103",
                    "$ref": "Users/4212450687312103"
                }
            ],
            "id": "304938786029663"
        },
        {
            "displayName": "TEST Group",
            "id": "738595786832639"
        }
    ]
}

```

From `/Users` , **id** field on the user is the nativeIdentity and the same is present under the group members on `/Groups` endpoint.

Is there a way that I can configure account aggregation on this source where the groups related information is also populated on the user accounts?

Appreciate any leads on how to achieve this if anybody else has faced a similar use case?

---

<div class="post-metadata">

**Author:** ![maheshtare](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@maheshtare](https://developer.sailpoint.com/discuss/u/maheshtare)\
**Post date:** [March 26, 2024, 10:48am UTC](https://developer.sailpoint.com/discuss/t/aggregate-entitlement-information-from-different-endpoint-and-populate-on-accounts-web-services-connector/37790/2 "2024-03-26T10:48:41Z")

</div>

Hi Arshad,

Check if this helps your use case or not.

> [@Reverse entitlement aggregation for Web Services connector](https://developer.sailpoint.com/discuss/t/reverse-entitlement-aggregation-for-web-services-connector/14198/4):
>
> Hello, After taking a look at the code I realized that there is no paging for the get entitlement call in the WSAO. and according to documentation, the limit of entitlements we can get is 250. This should be quick fix but I just wanted to report it in case someone is facing this problem. For info I have implemented the WSAO in one of my sources and it is working as expected. Thank you

Regards,  
Mahesh

---

<div class="post-metadata">

**Author:** ![iamology](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamology/32/6964_2.png) [@iamology](https://developer.sailpoint.com/discuss/u/iamology)\
**Post date:** [March 26, 2024, 12:17pm UTC](https://developer.sailpoint.com/discuss/t/aggregate-entitlement-information-from-different-endpoint-and-populate-on-accounts-web-services-connector/37790/3 "2024-03-26T12:17:50Z")

</div>

Have you considered calling Groups end point from AfterOperations rule and update the responseBody?

---

<div class="post-metadata">

**Author:** ![Arshad](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@Arshad](https://developer.sailpoint.com/discuss/u/Arshad)\
**Post date:** [April 4, 2024, 8:24am UTC](https://developer.sailpoint.com/discuss/t/aggregate-entitlement-information-from-different-endpoint-and-populate-on-accounts-web-services-connector/37790/4 "2024-04-04T08:24:25Z")

</div>

@iamology  
I am trying to do that same approach but facing a roadblock with figuring out the JSON query to fetch user’s groups. Can you see if you can help?  
Here’s the post where I’ve detailed it out : [JSON Query Path to fetch user groups in Web Service After Operation Rule](https://developer.sailpoint.com/discuss/t/json-query-path-to-fetch-user-groups-in-web-service-after-operation-rule/39181)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [June 3, 2024, 8:25am UTC](https://developer.sailpoint.com/discuss/t/aggregate-entitlement-information-from-different-endpoint-and-populate-on-accounts-web-services-connector/37790/5 "2024-06-03T08:25:00Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.