Bulk Role Creation & Assignment in SailPoint ISC – Alternative Approaches and Documentation Request

SailPoint Human Fabric (SHF) SHF Discussion and Questions
1

Hello All,
We have a requirement for bulk role creation and assignment in SailPoint ISC using a Ruby script. Could you please advise whether there are any alternative approaches available to achieve this requirement?

Also, the SailPoint Ruby Script documentation page is currently inaccessible. Please share any alternative documentation or reference materials available for Ruby script implementation in SailPoint ISC.

Thanks in advance.

2

Hi @gbalag ,

A couple of better options:

  • VS Code “Identity Security Cloud” extension – actively maintained, lets you bulk create/import roles and access profiles from a CSV. Probably the easiest drop-in replacement.
  • Direct API calls – POST /roles/v1 and POST /access-profiles/v1, looped over your CSV in whatever language you’re comfortable with (Python/PowerShell/Node all have official SDKs if you want one).
3

Hi @suraj_gorle ,
Thank you for the response and suggestions.

Could you please confirm how many roles can be created in a single API request in SailPoint ISC?

Additionally, please let us know where we can find the official documentation or reference for these limits.

4

Hi @gbalag ,
There’s no bulk endpoint — POST /roles/v1 creates one role per API call, so for N roles you’d loop N calls (same for POST /access-profile/v1). There’s no batch/array payload option on this endpoint.

Two limits worth knowing for planning bulk creation:

  • Org-wide cap: there’s a soft limit of 800 roles per org in ISC. Raise support request for exact limit.
  • Rate limit: API calls are capped at 100 requests per access token per 10 seconds. If you exceed it, you’ll get a 429 with a Retry-After header telling you how long to back off.

Loop the create calls, add a small delay/backoff to stay under the rate limit, and keep total role count in mind if you’re near 800.

5

from vs code you can create or upload the csv it will be easy

image
image1572×568 36 KB

6
  1. You can use python script or any scripting language.
  2. You can use postman and run the runner options for bulk.
  3. You can use Vscode .. Please let me know if you need anything you want to know more
7

Hi @gbalag ,

You can make use of available POST API calls for role/access profile creation by passing CSV payload where pre-defined mandatory attribute information is provided like role name, description, role owner, enabled(true or false), requestable(true or false) etc.

Once you determine the payload attributes, make use of available language SDK as suggested by others.

You can make use of Postman/Bruno as well for running collection in bulk.

Regards,

Bhushan Dhodi

8

Hi @gbalag ,

Is your environment allow PowerShell scripts, i used PowerShell scripts for bulk role creation.

Thanks,

Mahesh

9

HI Balaji,

you can use the Bulk import from the VS code , you just need to format in the excel sheet, with assignment as well with any no of entitlements with those roles.

I have done in past only time consumed in the formatting and for that also you can use format tools.

Thanks
Deepak

10

Hi @gbalag

You can use the SailPoint ISC API’s for Role and Access Profile creation. If you want to create in bulk then you can write script to execute this in loop.

Thanks

11 
#Requires -Version 5.1

param(
    [Parameter(Mandatory = $true)]
    [string]$CsvPath,

    [Parameter(Mandatory = $true)]
    [string]$TenantUrl,

    [Parameter(Mandatory = $true)]
    [string]$ClientId,

    [Parameter(Mandatory = $true)]
    [string]$ClientSecret
)

# Get OAuth token using client credentials
$tokenUrl = "$($TenantUrl.TrimEnd('/'))/oauth/token"
$tokenBody = @{
    grant_type    = "client_credentials"
    client_id     = $ClientId
    client_secret = $ClientSecret
}

$tokenResponse = Invoke-RestMethod -Method Post -Uri $tokenUrl -Body $tokenBody -ContentType "application/x-www-form-urlencoded"
$accessToken = $tokenResponse.access_token

# Roles endpoint
$rolesUrl = "$($TenantUrl.TrimEnd('/'))/v2025/roles"

$headers = @{
    "Content-Type"  = "application/json"
    "Accept"        = "application/json"
    "Authorization" = "Bearer $accessToken"
}

# Read CSV and create roles
$rows = Import-Csv -Path $CsvPath

foreach ($row in $rows) {
    $body = @{
        name = $row.name
        description = $row.desc
        owner = @{
            type = "IDENTITY"
            id   = ""
            name = ""
        }
        entitlements = @()
        accessProfiles = @()
        membership = @{
            type = "STANDARD"
            criteria = @{
                
            }
            identities = $null
        }
        legacyMembershipInfo = $null
        enabled = $false
        requestable = $false
        accessRequestConfig = @{
            commentsRequired           = $null
            denialCommentsRequired     = $null
            approvalSchemes            = @()
            reauthorizationRequired    = $false
            requireEndDate             = $false
            maxPermittedAccessDuration = $null
            formDefinitionId           = $null
        }
        revocationRequestConfig = @{
            approvalSchemes = @()
        }
        segments = @()
        dimensional = $false
        dimensionRefs = @()
        accessModelMetadata = @{
            attributes = @()
        }
        additionalOwners = @()
        privilegeLevel = $null
    }

    $jsonBody = $body | ConvertTo-Json -Depth 30
    $response = Invoke-RestMethod -Method Post -Uri $rolesUrl -Headers $headers -Body $jsonBody
    Write-Host "Created role: $($row.name) | Id: $($response.id)"
}
12

Continuing the discussion from Bulk Role Creation & Assignment in SailPoint ISC – Alternative Approaches and Documentation Request:

Hi All,

We recently tested the bulk creation of a set of roles through our PowerShell script, and the testing was successful.

A big thank you to everyone for your guidance, support, and valuable inputs. This would not have been possible without your help and collaboration.

Really appreciate all your support!