# Create-access-request API for non-requestable items

**URL:** <https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud\
**Created:** [October 1, 2024, 7:46pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544 "2024-10-01T19:46:40Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 1, 2024, 7:46pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/1 "2024-10-01T19:46:40Z")

</div>

I am looking for API to submit/ create the Access request even though entitlement is marked as non-requestable ?

[create-access-request | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/v2024/create-access-request)

---

<div class="post-metadata">

**Author:** ![mpotti](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mpotti/32/2916_2.png) [@mpotti](https://developer.sailpoint.com/discuss/u/mpotti)\
**Post date:** [October 1, 2024, 7:57pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/2 "2024-10-01T19:57:29Z")

</div>

When you build you payload do you get an error message for the object type you are trying to assign?

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 1, 2024, 8:20pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/3 "2024-10-01T20:20:10Z")

</div>

POST : {{baseUrl}}/access-requests

BODY:

```auto
{
  "requestedFor": [
    "8cfe5b64d9974XXXX14dacb024985f"
  ],
  "requestedItems": [
    {
      "id": "d6319162b21c4YYYY9d95ee491a",
      "type": "ENTITLEMENT",
      "comment": "Requesting access profile for Aabha"
    }
  ],
  "requestType": "GRANT_ACCESS"
}

```

RESPONSE :

```auto
{
    "detailCode": "400.1 Bad request content",
    "trackingId": "25402a6d354e4c738ac5dbefe7eb198a",
    "messages": [
        {
            "locale": "en-US",
            "localeOrigin": "DEFAULT",
            "text": "The following access items are not requestable: [d6319162b21c42ac9AAAA9d95ee491a]."
        },
        {
            "locale": "und",
            "localeOrigin": "REQUEST",
            "text": "The following access items are not requestable: [d6319162b21c4YYYY9d95ee491a]."
        }
    ],
    "causes": []
}

```

---

<div class="post-metadata">

**Author:** ![amansingh](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@amansingh](https://developer.sailpoint.com/discuss/u/amansingh)\
**Post date:** [October 1, 2024, 8:26pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/4 "2024-10-01T20:26:29Z")

</div>

Hey Vishal,

We cannot call an access request API and it will only perform the GRANT\_ACCESS and or REVOKE\_ACCESS only when you have made the said Entitlement/Access Profile/Role as Requestable within ISC/IDN.

So your first call would be to make the requestable API and then the access request API.

Thanks,  
Aman

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 1, 2024, 8:31pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/5 "2024-10-01T20:31:10Z")

</div>

Thank you Aman ,

I understand that we can’t make the API call for the access-requests until the request item is requestable and i can see that in error .

I am looking for any other API , which has capability / permission to submit the request even though the request item is non-requestable .

---

<div class="post-metadata">

**Author:** ![arjun\_sengupta](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/arjun_sengupta/32/3594_2.png) [@arjun\_sengupta](https://developer.sailpoint.com/discuss/u/arjun_sengupta)\
**Post date:** [October 1, 2024, 8:33pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/6 "2024-10-01T20:33:30Z")

</div>

Hi Vishal,

it may not work if the entitlement is non-requestable.  
I tried it when this feature was released a few months back, the API gave error as it was non-requestable.

Regards  
Arjun

---

<div class="post-metadata">

**Author:** ![jrossicare](https://avatars.discourse-cdn.com/v4/letter/j/a698b9/32.png) [@jrossicare](https://developer.sailpoint.com/discuss/u/jrossicare)\
**Post date:** [October 2, 2024, 1:31am UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/7 "2024-10-02T01:31:56Z")

</div>

> [@vishal\_kejriwal1](#):
>
> I am looking for any other API , which has capability / permission to submit the request even though the request item is non-requestable .

it is not possible. Item has to be requestable if you want to request it.

What is your scenario / use case? What are you trying to achieve?

If you want to hide the item from access requests, then you need to create a segment so it not visible to users.

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 2, 2024, 3:08am UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/8 "2024-10-02T03:08:18Z")

</div>

I want to generate access request as part of ncd detection .

---

<div class="post-metadata">

**Author:** ![mpotti](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mpotti/32/2916_2.png) [@mpotti](https://developer.sailpoint.com/discuss/u/mpotti)\
**Post date:** [October 2, 2024, 11:20am UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/9 "2024-10-02T11:20:52Z")

</div>

Can you please provide more details on this solution? I will be having some similar requirements coming up in the near future where I will be asked to leverage API’s to grant access to a number of AD groups. We would want this to be completely transparent to the end users and to make sure that the Request Center is not visible with any access. But allow a system like ServiceNow to make an API call to request the access be granted.

I know that Managed Access in Service Now is available however the time to set it up and develop out all the required information is going to take a lot more time then if I work with the ServiceNow Team to set up the required API calls for their workflow for existing access request.

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [October 2, 2024, 12:51pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/10 "2024-10-02T12:51:07Z")

</div>

As others have mentioned, you cannot use the create access request API to request access for non-requestable items. Your access item(s) must be marked as requestable before you can use this API. I’m not quite sure what your use case is, but here are some suggestions for assigning access to non-requestable items.

1. Temporarily modify the item to make it requestable so you can you submit the access request, and then immediately modify the item again to make it non-requestable. Roles, access profiles, and entitlements each have a PATCH endpoint to update the requestable field. Here’s the endpoint for entitlements: [patch-entitlement | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/v2024/patch-entitlement)
2. Add the entitlement to a role and assign identities directly to the role. This would not go through the access review process, so if you need some sort of approval/audit trail, you will need to build a system externally or in workflows to capture the approvals. You can use [patch-role | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/v2024/patch-role) to add identities to the `membership` array.
3. As @jrossicare mentioned, you could create a segment to hide the entitlement. This would allow you to mark it as requestable but only a select group of identities can actually submit the access request. This group of identities could be admins or other privileged users that can submit the access request on behalf of other identities. I’m not sure of the exact details to make this work, but it could be worth exploring.

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 2, 2024, 1:23pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/11 "2024-10-02T13:23:01Z")

</div>

> [@vishal\_kejriwal1](#):
>
> I want to generate access request as part of ncd detection .

I want to generate access request as part of ncd detection .

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 2, 2024, 1:24pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/12 "2024-10-02T13:24:33Z")

</div>

I understand that we can mark temporarily entitlement as requestable , but i again it can have it’s own pro/cons.

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [October 2, 2024, 1:25pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/13 "2024-10-02T13:25:23Z")

</div>

Can you please elaborate? Why does native change detection require you to request non-requestable entitlements? Please be thorough in the description of your use case.

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 2, 2024, 1:30pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/14 "2024-10-02T13:30:35Z")

</div>

Thank you @colin_mckibben .

We want to generate the access request to be generated for the any NCD detection so that loop can be closed . it may happen that some of the high risk item detected as part of the NCD is non-requestable item .

We have explored the option to generate the form , but problem is that form can be assigned to one user only . also i think form can be notified only though the email it won’t be visible to the actor UI laying out that item is pending .

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [October 2, 2024, 1:31pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/15 "2024-10-02T13:31:38Z")

</div>

Is this to revoke an entitlement or grant access?

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 2, 2024, 1:32pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/16 "2024-10-02T13:32:32Z")

</div>

its would be for revoking the entitlement .

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [October 2, 2024, 1:38pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/17 "2024-10-02T13:38:18Z")

</div>

So from my perspective, ISC should be the source of truth for what access an identity should have on a source system. NCD will tell you when an identity has obtained out-of-band access (i.e. somehow they got access to an entitlement on the source without ISC granting it). If a user got access to something outside of the process provided by ISC, then you need to revoke that access directly on the source. You could either manually remove their access or setup a system that can automatically remove the access using the APIs provided by the source system.

Workflows can help with this. You can setup a workflow to listen to NCD events, and if you spot one then you can have the workflow invoke the HTTP Request Action to directly remove the out-of-band access from the user on the source. You could also create a micro-certification campaign to revoke the access. Check out this blog post by @Bassem_Mohamed. I think this can help you solve your use case.

> [@Native Change Detection Using Workflows](https://developer.sailpoint.com/discuss/t/native-change-detection-using-workflows/19885):
>
> Introduction Read this blog to learn how to implement the Native Change Detection Workflows solution. This solution provides a way to automate out-of-band access that has been granted or revoked. This solution is built based on the Native Change Detection Updates event trigger. This solution involves the following pieces: Dynamic Form: Native Change Detection Form Native Change Detection Workflow: Added Entitlements Native Change Detection Workflow: Removed Enti…

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 2, 2024, 1:56pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/18 "2024-10-02T13:56:50Z")

</div>

I do agree with you @colin_mckibben that all the request should go from the central IGA . but in real time scenario that would be difficult and could have multiple different reason .

---

<div class="post-metadata">

**Author:** ![vishal\_kejriwal1](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vishal_kejriwal1/32/10904_2.png) [@vishal\_kejriwal1](https://developer.sailpoint.com/discuss/u/vishal_kejriwal1)\
**Post date:** [October 2, 2024, 2:02pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/19 "2024-10-02T14:02:25Z")

</div>

This solution is great but i see some challenges meeting my requirement

1. Form can be assigned only to individual actor
2. how actor will know if something is pending apart from email link.

When we talk about close loop i think its better to have the same approval process as when you raise the request for same item from ISC.

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [October 2, 2024, 2:55pm UTC](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544/20 "2024-10-02T14:55:21Z")

</div>

The blog post also mentions that you can trigger a microcertification campaign that only reviews the access item that was granted out-of-band. That would give you more control over the approval process.

[Next page](https://developer.sailpoint.com/discuss/t/create-access-request-api-for-non-requestable-items/83544.md?page=2)