# API to get roles, access profile and entitlement to users and remove it all from from identity

**URL:** <https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723>\
**Category:** SHF Discussion and Questions\
**Tags:** api, access-profiles, sailpoint-identity-security, roles, entitlements\
**Created:** [May 7, 2025, 9:21am UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723 "2025-05-07T09:21:40Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amrit1897](https://avatars.discourse-cdn.com/v4/letter/a/65b543/32.png) [@Amrit1897](https://developer.sailpoint.com/discuss/u/Amrit1897)\
**Post date:** [May 7, 2025, 9:21am UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/1 "2025-05-07T09:21:40Z")

</div>

Can anyone please help me with API to get roles, access profile and entitlement assigned to users and remove them from from identity?

---

<div class="post-metadata">

**Author:** ![neeraj99](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/neeraj99/32/14001_2.png) [@neeraj99](https://developer.sailpoint.com/discuss/u/neeraj99)\
**Post date:** [May 7, 2025, 10:13am UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/2 "2025-05-07T10:13:40Z")

</div>

Hi @amishra25

You can try the below api endpoint to remove the AP/Ent/Roles from the identity.

> **[create-access-request | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/beta/create-access-request)**
>
> \<Heading

Hope this helps.

---

<div class="post-metadata">

**Author:** ![kanusha9](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kanusha9/32/37041_2.png) [@kanusha9](https://developer.sailpoint.com/discuss/u/kanusha9)\
**Post date:** [May 7, 2025, 1:01pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/3 "2025-05-07T13:01:38Z")

</div>

Hi,check the below APi’s

> **[get-access-request-config | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/beta/get-access-request-config)**
>
> \<Heading

> **[list-identities | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/beta/list-identities)**
>
> \<Heading

> **[get-role | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/beta/get-role)**
>
> \<Heading

> **[list-entitlements | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/beta/list-entitlements)**
>
> \<Heading

---

<div class="post-metadata">

**Author:** ![Amrit1897](https://avatars.discourse-cdn.com/v4/letter/a/65b543/32.png) [@Amrit1897](https://developer.sailpoint.com/discuss/u/Amrit1897)\
**Post date:** [May 8, 2025, 12:16pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/4 "2025-05-08T12:16:39Z")

</div>

It requires id of AP/Ent/Roles. Is there any API available to fetch id of AP/Ent/Roles assigned to an identity?

---

<div class="post-metadata">

**Author:** ![Amrit1897](https://avatars.discourse-cdn.com/v4/letter/a/65b543/32.png) [@Amrit1897](https://developer.sailpoint.com/discuss/u/Amrit1897)\
**Post date:** [May 8, 2025, 12:18pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/5 "2025-05-08T12:18:20Z")

</div>

I need API for AP/Ent/Roles assigned to an identity.  
Then other API to remove it from identity.

---

<div class="post-metadata">

**Author:** ![ipobeidi](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ipobeidi/32/16000_2.png) [@ipobeidi](https://developer.sailpoint.com/discuss/u/ipobeidi)\
**Post date:** [May 8, 2025, 12:21pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/6 "2025-05-08T12:21:20Z")

</div>

There is, people these days are just spamming links and not actually help people.

If you want tog rab the ROles , AP and Entitlements of a identity , you need to use Search, with the following body :

```auto
{"indices":
["identities"],
"query":{
   
       "query":"id:6e2265a5000149068d8a9fef754ab657",
               
       },
       "includeNested":true
       
       }

```

The fiueld Included nested you bring you all the Access and APPs people have. you can them determine by the type capture it. and use to remove it.

Now you can also use Innerhit and get specific access with specific caracteristics. Ex:

```auto
{"indices":
["identities"],
"query":{
    
        "query":"id:6e2265a5000149068d8a9fef754ab657",
        "innerHit":{
            "type":"access",
            "query":"standalone:true AND source.name:\"AD SOURCE\""
        }
        
        },
        "includeNested":false,
        "queryResultFilter":{
            "includes":["access.id","access.source.name"]
        }
        }

```

Standalone means if the access comes from the source and is not attached to any AP or Roles.

To remove the access you can Use certifications or even access requests.

Have fun.

---

<div class="post-metadata">

**Author:** ![Amrit1897](https://avatars.discourse-cdn.com/v4/letter/a/65b543/32.png) [@Amrit1897](https://developer.sailpoint.com/discuss/u/Amrit1897)\
**Post date:** [May 13, 2025, 2:02pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/7 "2025-05-13T14:02:23Z")

</div>

Thanks @ipobeidi , I believe we don’t have any other v3/beta API apart from access requests( [https://sailpoint.api.identitynow.com/beta/access-requests](https://sailpoint.api.identitynow.com/beta/access-requests)) to remove access. Can you please confirm?

---

<div class="post-metadata">

**Author:** ![ipobeidi](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ipobeidi/32/16000_2.png) [@ipobeidi](https://developer.sailpoint.com/discuss/u/ipobeidi)\
**Post date:** [May 13, 2025, 3:55pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/8 "2025-05-13T15:55:17Z")

</div>

IMO to remove would be better the Certification than the remove access. Because remove access doe snot solve the sticky entitlement issue.

---

<div class="post-metadata">

**Author:** ![suresh4iam](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/suresh4iam/32/29513_2.png) [@suresh4iam](https://developer.sailpoint.com/discuss/u/suresh4iam)\
**Post date:** [May 13, 2025, 4:25pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/9 "2025-05-13T16:25:46Z")

</div>

If you can use Workflow, look at [Workflow to remove ALL leavers' standing access](https://developer.sailpoint.com/discuss/t/workflow-to-remove-all-leavers-standing-access/13025) which fulfil your requirement.

---

<div class="post-metadata">

**Author:** ![kanusha9](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kanusha9/32/37041_2.png) [@kanusha9](https://developer.sailpoint.com/discuss/u/kanusha9)\
**Post date:** [June 18, 2025, 4:57pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/10 "2025-06-18T16:57:56Z")

</div>

1. List Roles/Access Profiles/Entitlements Assigned to an Identity:

([https://sailpoint.api.identitynow.com/v3/identity-profiles](https://sailpoint.api.identitynow.com/v3/identity-profiles))

2.Remove Role/Entitlement/Access Profile from an Identity:

POST /beta/access-requests

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [August 17, 2025, 4:58pm UTC](https://developer.sailpoint.com/discuss/t/api-to-get-roles-access-profile-and-entitlement-to-users-and-remove-it-all-from-from-identity/125723/11 "2025-08-17T16:58:15Z")

</div>

Closed on August 17, 2025, 4:58pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.