API to Assign Entitlement/Access Profile/Role to an Identity in SailPoint IDN

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Community,
I’m looking for an API in SailPoint IdentityNow that can be used to programmatically assign an given Entitlement, Access Profile, or Role to an identity.
Can anyone please guide me on which API to use and share any sample payloads or documentation references?

Thanks in advance!

2

Hello @hkhandale

You can use the following API , if the access item is configured for approval it goes through the approval process .

Hope this helps!

Thanks
Sid

3

Hi @hkhandale

In case you need this, here’s the required request body of this API call.

{
  "requestedFor": [
    "Id of the Identity"
  ],
  "requestType": "GRANT_ACCESS",
  "requestedItems": [
    {
      "type": "ACCESS_PROFILE",
      "id": "Id of the Access Profile,
      "comment": "Requesting AP through API Call"
    }
  ]
}

OR

For Entitlement the type would be;
"type": "ENTITLEMENT",
"id": "Id of the entitlement,

OR
For Role the type would be;
"type": "ROLE",
"id": "Id of the role,

4

Thanks @nhassan

I am getting success code 202 but as i checked identity the access profile is not assigned.

{64B94280-9997-4C78-B26F-223CA81BE4AD}
{64B94280-9997-4C78-B26F-223CA81BE4AD}1250×890 73.7 KB

image
image1321×501 26 KB

Below one is access profile configuration

{BC19BFBF-0CA7-4FE5-8989-C317BF4E01F0}
{BC19BFBF-0CA7-4FE5-8989-C317BF4E01F0}1894×911 44.7 KB

5

@hkhandale
Please navigate to Request Centre > My Requests. There, you should find the request you submitted. It will provide details on why the access item has not been provisioned.

Screenshot 2025-05-01 at 4.20.05 PM
Screenshot 2025-05-01 at 4.20.05 PM2492×428 26.3 KB

6

Hi @hkhandale

This should work as I’ve just tested it in the sandbox.

Is the access profile from a direct connection source e.g AD/AAD? If it’s from a flat file source e.g Jira Access Requests, then make sure user has active Jira account to be able to create a ticket for this access.

As @sidharth_tarlapally mentioned, look for any error when you navigate to Request Centre > My Requests .

Or, in the main search, type in "displayName" of the identity > in the recent account activity log, check the status whether or not it’s completed and look for any error to see the reason that why it’s failed.

1 Like
8

Yes @nhassan , i am using AD access profile

9

Thanks Guys it is working now

1 Like