API to get roles, access profile and entitlement to users and remove it all from from identity

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

Can anyone please help me with API to get roles, access profile and entitlement assigned to users and remove them from from identity?

2

Hi @amishra25

You can try the below api endpoint to remove the AP/Ent/Roles from the identity.

Hope this helps.

1 Like
3

Hi,check the below APi’s

1 Like
4

It requires id of AP/Ent/Roles. Is there any API available to fetch id of AP/Ent/Roles assigned to an identity?

5

I need API for AP/Ent/Roles assigned to an identity.
Then other API to remove it from identity.

6

There is, people these days are just spamming links and not actually help people.

If you want tog rab the ROles , AP and Entitlements of a identity , you need to use Search, with the following body :

{"indices":
["identities"],
"query":{
   
       "query":"id:6e2265a5000149068d8a9fef754ab657",
               
       },
       "includeNested":true
       
       }

The fiueld Included nested you bring you all the Access and APPs people have. you can them determine by the type capture it. and use to remove it.

Now you can also use Innerhit and get specific access with specific caracteristics. Ex:

{"indices":
["identities"],
"query":{
    
        "query":"id:6e2265a5000149068d8a9fef754ab657",
        "innerHit":{
            "type":"access",
            "query":"standalone:true AND source.name:\"AD SOURCE\""
        }
        
        },
        "includeNested":false,
        "queryResultFilter":{
            "includes":["access.id","access.source.name"]
        }
        }

Standalone means if the access comes from the source and is not attached to any AP or Roles.

To remove the access you can Use certifications or even access requests.

Have fun.

1 Like
7

Thanks @ipobeidi , I believe we don’t have any other v3/beta API apart from access requests( https://sailpoint.api.identitynow.com/beta/access-requests) to remove access. Can you please confirm?

8

IMO to remove would be better the Certification than the remove access. Because remove access doe snot solve the sticky entitlement issue.

9

If you can use Workflow, look at Workflow to remove ALL leavers' standing access which fulfil your requirement.

10
  1. List Roles/Access Profiles/Entitlements Assigned to an Identity:

(https://sailpoint.api.identitynow.com/v3/identity-profiles)

2.Remove Role/Entitlement/Access Profile from an Identity:

POST /beta/access-requests

2 Likes