# API triggered Role certification based on Metadata attribute

**URL:** <https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud, api, certifications\
**Created:** [March 16, 2026, 2:43pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594 "2026-03-16T14:43:12Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![aleksander\_jachowicz](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aleksander_jachowicz/32/22938_2.png) [@aleksander\_jachowicz](https://developer.sailpoint.com/discuss/u/aleksander_jachowicz)\
**Post date:** [March 16, 2026, 2:43pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594/1 "2026-03-16T14:43:12Z")

</div>

Part of the mover requirement is to trigger role certification for the moving identity but only Include roles that have specific values of the custom metadata attribute.

So this certification needs to be triggered from the workflow.

My plan is to use Create a campaign endpoint and create a campaign of type SERCH. In searchCampaignInfo I will have type IDENTITY and assign specific identity as reviewer (this is the old manager). And finally, I need to set filter to only include specific roles which mean I need “Campaign Filter”.

I managed to create a search query that filter such roles:

```auto
@accessModelMetadata(value:"3") AND @accessModelMetadata(name:"Risk level")

```

But how do I use this inside “Campaign Filter”?

---

<div class="post-metadata">

**Author:** ![trettkowski](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/trettkowski/32/36103_2.png) [@trettkowski](https://developer.sailpoint.com/discuss/u/trettkowski)\
**Post date:** [March 16, 2026, 2:59pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594/2 "2026-03-16T14:59:22Z")

</div>

Hi @aleksander_jachowicz

This definitely looks do-able. Instead of using the type `IDENTITY` in your `searchCampaignInfo`, I would use the `ACCESS` type instead and utilize the `query` parameter in the call to pass your search query that you provided. Also, you will need to pass the identity ID into the `identityIds` section to make sure only that identity is being certified.

I wouldn’t use a campaign filter in this case since it seems you can filter the access criteria and the identities you want included using other parameters. If you wanted to exclude extra criteria that you couldn’t with your search query you provided, then I think a campaign filter would be necessary.

Let me know if this works for you or if you have any questions or concerns on the approach.

---

<div class="post-metadata">

**Author:** ![aleksander\_jachowicz](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aleksander_jachowicz/32/22938_2.png) [@aleksander\_jachowicz](https://developer.sailpoint.com/discuss/u/aleksander_jachowicz)\
**Post date:** [March 16, 2026, 3:24pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594/3 "2026-03-16T15:24:59Z")

</div>

Hi @trettkowski  
But if I use ACCESS my understanding is that query only limits the identities being certified not which roles are being certified.

Isn’t filter the only part that limits what is being certified?

---

<div class="post-metadata">

**Author:** ![trettkowski](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/trettkowski/32/36103_2.png) [@trettkowski](https://developer.sailpoint.com/discuss/u/trettkowski)\
**Post date:** [March 16, 2026, 3:39pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594/4 "2026-03-16T15:39:08Z")

</div>

No, this limits what access is being certified. For this to work properly, you would need to use the ACCESS query as well as populating the `identityIds` under `searchCampaignInfo`. The search query will only certify the access you specified and the `IdentityIds` will include only the identity ID’s you specified.

Here is an example campaign payload that I’ve confirmed only includes access relevant to a source and I’m excluding based on a list of identity ID’s:

```auto
$CampaignPayload = @{
    name = "$sourceName Access Review - Status: Active - $(Get-Date -Format 'yyyy-MM-dd')"
    description = "Filtered campaign for $sourceName source via PowerShell script."
    type = "SEARCH"
    searchCampaignInfo = @{
        type = "ACCESS"
        query = "source.name:" + '"' + $sourceName + '"'
        identityIds = $TargetIdentityIds
        reviewerType = "MANAGER"
    }
    schedule = @{
        type = "ONCE"
    }
} | ConvertTo-Json -Depth 10

```

---

<div class="post-metadata">

**Author:** ![aleksander\_jachowicz](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aleksander_jachowicz/32/22938_2.png) [@aleksander\_jachowicz](https://developer.sailpoint.com/discuss/u/aleksander_jachowicz)\
**Post date:** [March 16, 2026, 3:41pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594/5 "2026-03-16T15:41:21Z")

</div>

OK, I’ll test this. Thanks for the input so far.

---

<div class="post-metadata">

**Author:** ![aleksander\_jachowicz](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aleksander_jachowicz/32/22938_2.png) [@aleksander\_jachowicz](https://developer.sailpoint.com/discuss/u/aleksander_jachowicz)\
**Post date:** [March 16, 2026, 4:59pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594/6 "2026-03-16T16:59:18Z")

</div>

You are right @trettkowski this does work as you explained

---

<div class="post-metadata">

**Author:** ![aleksander\_jachowicz](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aleksander_jachowicz/32/22938_2.png) [@aleksander\_jachowicz](https://developer.sailpoint.com/discuss/u/aleksander_jachowicz)\
**Post date:** [March 16, 2026, 5:01pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594/7 "2026-03-16T17:01:14Z")

</div>

For future reference if someone reads this my body is:

```json
{
    "name": "Mover old manager review",
    "description": "A review of critical access by old manager.",
    "deadline": "2026-12-25T06:00:00.468Z",
    "type": "SEARCH",
    "emailNotificationEnabled": false,
    "autoRevokeAllowed": false,
    "recommendationsEnabled": false,
    "searchCampaignInfo": {
        "reviewer": {
            "type": "IDENTITY",
            "id":" ********"
        },
        "type": "ACCESS",
        "identityIds": [
            " ***********"
        ],
        "query": "@accessModelMetadata(value:\"3\") OR name:\"Accounting (Norway)\""
    },
    "mandatoryCommentRequirement": "NO_DECISIONS"
}

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [May 15, 2026, 5:01pm UTC](https://developer.sailpoint.com/discuss/t/api-triggered-role-certification-based-on-metadata-attribute/199594/8 "2026-05-15T17:01:22Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.