# Before Provisioning Rule Application Object

**URL:** <https://developer.sailpoint.com/discuss/t/before-provisioning-rule-application-object/90366>\
**Category:** SHF Discussion and Questions\
**Tags:** rules, sailpoint-identity-security\
**Created:** [November 20, 2024, 7:15pm UTC](https://developer.sailpoint.com/discuss/t/before-provisioning-rule-application-object/90366 "2024-11-20T19:15:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![josephcasale](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@josephcasale](https://developer.sailpoint.com/discuss/u/josephcasale)\
**Post date:** [November 20, 2024, 7:15pm UTC](https://developer.sailpoint.com/discuss/t/before-provisioning-rule-application-object/90366/1 "2024-11-20T19:15:52Z")

</div>

I am looking to perform some validation on the application associated with a before provisioning rule in real time.

I believe the application object passed into the rule contains the credentials for the application, but looking at another forum [post](https://developer.sailpoint.com/discuss/t/sample-code-for-moving-the-account-to-the-deleted-archived-container-in-the-ldap-connector/87349/2), it appears they need to be decrypted using the context object.

Are they encrypted in a before provisioning rule, and if so, is that context instance available?

Thanks

---

<div class="post-metadata">

**Author:** ![iamnithesh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamnithesh/32/42445_2.png) [@iamnithesh](https://developer.sailpoint.com/discuss/u/iamnithesh)\
**Post date:** [November 25, 2024, 9:22pm UTC](https://developer.sailpoint.com/discuss/t/before-provisioning-rule-application-object/90366/2 "2024-11-25T21:22:14Z")

</div>

I am not sure what exactly are you trying to achieve here, but just FYI

1. You are not supposed to make any API call from cloud rules
2. Use of context object has been discontiued by SailPoint, meaning you cannot use context object in any of the cloud rules you are going to submit in the future

Here is a quick read on cloud rule guidelines:

> **[Rules | SailPoint Developer Community](https://developer.sailpoint.com/docs/extensibility/rules#rule-guidelines)**
>
> Advanced configurations with custom logic.

---

<div class="post-metadata">

**Author:** ![josephcasale](https://avatars.discourse-cdn.com/v4/letter/j/fbc32d/32.png) [@josephcasale](https://developer.sailpoint.com/discuss/u/josephcasale)\
**Post date:** [November 25, 2024, 11:14pm UTC](https://developer.sailpoint.com/discuss/t/before-provisioning-rule-application-object/90366/3 "2024-11-25T23:14:45Z")

</div>

HI @iamnithesh  
I received confirmation from support that source credentials are not encrypted.

With respect to api calls, we need to ensure that username generation performed in a before provisioning rule is known to be valid (as best as SailPoint can accommodate) by checking multiple external integrations.

Other platforms offer the concept of reservations and connector initiated verifications, since ISC does not support the later in any but LDAP based connectors, we don’t have much choice.

The alternative is to guess oir assume and hope for the best, which is not optimal.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [January 24, 2025, 11:15pm UTC](https://developer.sailpoint.com/discuss/t/before-provisioning-rule-application-object/90366/4 "2025-01-24T23:15:19Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.