Client Credentials fail with Role API

[chris-hogan]

Hi Chris,

Some API endpoints simply require a PAT to be used by nature. You can read more from SailPoint and other ambassadors about this topic in this thread:

API Scopes Not Working Broken Feature

Scopes are intended to scope down access on PATs to create tokens with the least privilege necessary to fulfill their functions: The vast majority of ISC APIs require ORG_ADMIN user level, and that user level context can be provided by a PAT with the client credentials grant flow or by a user actively logging in with the authorization code grant flow when generating a token. We understand the frustration with this requirement, and we hear the feedback loud and clear to provide application ba…

Personally, I manage this constraint by creating a service account identity under a delimited file source for which I generate PATs under as if they were client credentials, that way I know that identity will not get offboarded and the PAT is not linked to a real identity. Then the login credentials for the identity can be managed in the organization’s PAM tool.