API to get accounts assigned to a specific entitlement?

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi everyone,

I need to find all accounts that have a specific entitlement in ISC.

Currently, I am doing this:

  1. Get all accounts for the source/application.
  2. Check attributes.groups for each account.
  3. Match the entitlement value.
  4. Keep only the accounts where the entitlement exists.

This works, but it means scanning all accounts for the source.

Is there a better way to do this?

I could not find a direct API like:

get accounts by entitlement id/value

Is there any way Search API may support queries like:

@accounts(source.id:"<sourceId>" AND entitlementAttributes.groups:"<entitlementValue>")

Or is filtering /v2025/accounts Manually, the only reliable way?

2

The Search API always returns identity‑centric results, not account‑level details. At the moment, there is no supported endpoint in ISC that directly solves this use case of finding accounts by entitlement.

3

@shsakshi the accounts object is not directly available in the search module.

However, for example, the following query will retrieve all identities for which a particular entitlement is assigned:

@access(name:"yourEntitlementValue" AND type:"ENTITLEMENT"  AND source.name:"yoursourcename")

In the results, you will get a list of identities (including all their accounts from different sources, but only the account IDs and a few additional attributes are returned). Uncorrelated accounts will not appear.

Same example using search API :

{
    "query": {
        "query": "@access(name:\"Administrator\" AND type:\"ENTITLEMENT\"  AND source.name:\"IdentityNow\")"
    },
    "indices": [
        "identities"
    ],
    "includeNested": true,
    "queryResultFilter": {
        "includes": [
            "name",
            "id",
            "access",
            "accounts"
        ]
    }
}

image
image832Ă—925 44.2 KB

However, if your use case focuses on accounts rather than identities, your current approach is appropriate, even though it is not fully optimized.

4

Great answer, @baoussounda !

5

As mentioned by @ROHPU & @baoussounda , the Search API supports querying identities, roles, access profiles, entitlements, events, & account activities, but it does not support querying accounts directly.

image
image1463Ă—1040 105 KB

Source: https://developer.sailpoint.com/docs/api/v3/search/

6

Hi @shsakshi as per the posted message i understand that you want all the accounts of a source on which a Specific entitlement exists..
For that you can use this search.

{
  "indices": [
    "identities"
  ],
  "query": {
    "query": "@accounts(source.name:\"Auth Source\") && @access(name:\"Meetings\")"
  },  "queryResultFilter" : {
  "includes":[
    "attributes.uid",
    "attributes.displayName",
    "name"
  ]}
}

It would specifically narrow down the results to a specific source i.e in this case (Auth Source), with entitlement (Meetings).

Making the query result as: all the identities which have an account on the Auth Source having entitlement Meetings.

Moreover you limit the number of attributes returned by using queryResultFilter to get specific data only.

Lastly, to get the account Id, you could just use a simple JSON path filter Something like:

$[*].accounts[?(@.source.name=="Auth Source")].accountId
To get all the accounts Id, which has the account on the source.

Hope this helps.