Certification campaign closure date

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I’m trying to retrieve the list of campaigns which have closed during a particular window.

By closed I mean either an admin closed the campaign or the last user has signed off their certification.

The API call /beta/campaigns does not appear to have a closure date in it. Is this information available in any way on the campaign?

2

Hi Ramiro,

Ideally, the list of campaigns endpoint would keep track of the date when all certifications have been signed off. However, this is not available at this time. I went ahead and created an idea to provide this data directly in the list campaigns endpoint. Please up vote so the product team can prioritize this work.

In the meantime, since a campaign can have more than one certification, you will need to string together a few API calls to make this work. This will be easier if you create a script in your favorite language to do the work.

You can start by getting a list of campaigns, filtered using status eq "COMPLETED" in the query params. You will also want to use the detail=FULL query param to get additional fields that we can use to accomplish your task.

GET https://{tenant}.api.identitynow.com/beta/campaigns?detail=FULL&status eq "COMPLETED"

Since the list of completed campaigns will continuously grow over time, we don’t want to analyze any campaigns that are either far too old to be considered for this query, or that we have already analyzed in a previous run of the script. You can throw out any campaigns that have a deadline that is well before your window. If you are feeling adventurous, you can keep track of which campaigns you have already analyzed in a file or database so you can throw them out as well.

Once you have your list of campaigns that you want to analyze when they were completed, we can move on to the list identity certifications endpoint. For each campaign, run the following API call:

GET https://{tenant}.api.identitynow.com/v3/certifications?filters=campaign.id eq "<campaignId>"&sorters=-signed

This will return all of the certifications for the specified campaign in descending order of when they were signed. Use the certification with the most recent signed date (should be the first item in the array) to see if it falls within your window. If it does, add the campaign to the list of campaigns that were completed within your window.

I know this is a lot of work for what should be a simple query, but this is the only way I can see this working for now. If you manage to get this working, please share your final code/solution with us to help anyone else with the same question.

1 Like
3

Thanks Colin, I thought of a similar approach but was concerned about having to go through every single certification in every single closed campaign, which in our environment probably would have taken hours!

But this looks like just one additional call required per campaign which is much more manageable.

A couple of additional questions:

  1. Are we able to sort the completed list by deadline as well? The documentation for the campaign list API states:
    Sorting is supported for the following fields: name
    So it seems that it’s not possible to sort by deadline. Sorting by name is not very useful either.
    What is the default sort? Is it by create date? At least we can start discarding campaigns which have been created too long ago without necessarily having to pull every single completed campaign.

  2. If a certification is closed by an admin (i.e., because it was not completed by the reviewer and the admin closes the campaign), is it still considered “signed”? And the timestamp on “signed” is the time that the admin closed the campaign?

4

For your first question, only name is a supported sorter, which is not helpful for this use case. There is no default sorting on campaigns.

I don’t have an answer for your second question. This would require a test to see what happens when you close a campaign as an admin.

5

Thanks Colin,

After some development and testing, it seems that closing campaign as admin does set the “signed” date to be the time the admin closed the campaign. So this solution is working for us (although I do still need to validate it with campaigns completed over a number of days, this will take me a few days to test for obvious reasons :upside_down_face:).

Here’s the relevant code:


		String encodedFilterString = URLEncoder.encode("campaign.id eq \"" + campaign.id + "\"", "UTF-8");
		RestApiResponse r = client.sendRequest("GET", "v3/certifications?filters=" + encodedFilterString + "&sorters=-signed");
		Certification[] c = gson.fromJson(r.body, Certification[].class);
		Instant closureTime = Instant.parse(c[0].signed);

		return closureTime.atZone(ZoneId.systemDefault());

...

		LocalDate closureDate = closureTime.toLocalDate();
		LocalDate now = LocalDate.now(ZoneId.systemDefault()).minusDays(1);
		
		return now.equals(closureDate);

Hope this helps anyone else trying to solve the same issue!

2 Likes