Create Account API Clarifications

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi, we have a requirement to create an account in SailPoint via API. When we use the create-account API, the task was successful, but the account was not reflected in IDN under the target source.

API: https://{tenant}.api.identitynow.com/v3/accounts
Body: (attached screenshot)

Are there any documentations where we can see what to specify in the JSON body? We’ve reviewed the current document (create-account | SailPoint Developer Community) but it only mentions to put in property values but did not specify what properties to include.

jsonbody
jsonbody779×700 21.2 KB

2

Hi Ang,
Create - Account API only works for Delimited Application type. If you have a direct Connector then it does not work.

Could you please let us know what is your Connector Type ?

3

Hi Rakesh,

I’m using a Direct connector, seems like in this case create-account API wouldn’t work.

In that case, is there another way for me to create an account in the target source using the API for direct connectors?

4

Hi Ang,

Use IdentityNow connector we can create account in target.

You can use Provisioning Policy.Attached is the policy for more details.

https://developer.sailpoint.com/idn/docs/transforms/uides/transforms-in-provisioning-policies

5

Hi Rakesh,

Do you mean that I can create account by using the create provision policy API and passing in a JSON with static values for this new account?

Because from what I understand, the api only created the policy (which is the template) and not the account itself.

6

Hi Ang,
So you need to create the Provisioning Policy and then go in IdentityNow → Connection-> Source → Open the Source and under that Create Account. The poliy will be visible there. Populate the values which you need to send to the target and go to Entitlements tabs mark any entitlement i.e group coming from AD as requestable. Go to Request Center → Request the Entitlement and after which IdentityNow will take care of creating the account based on the attributes you have populated in the Provisioning Policy.

Hope this helps. Please let us know if you need further clarification. I will also recoomend you to go through the follwing document and help understand how IdentityNow works.

7

No document says that you can create only in Delimited application.

9

Hey Krishna,
So using create-account api we can directly call any source and create account in target system ? This will be very helpful api to directly create account in target without using connector which will solve most of the issues.

10

We need to create source of course. When you call create account API, you are invoking operation on the source rite by passing source ID. API document doesn’t says that it is limited to Delimited application. We should do more testing to confirm on this.

11

Yeah that was my understanding that we create local accounts in IdentityNow rather than target and we have used this in our current Production environment as per recommendation from Sailpoint support.

12

Let’s see what SailPoint says on this, then probably we can ask for API document update, so that we can avoid these confusions.

13

@colin_mckibben : Please correct us if our understanding is not correct

1 Like
14

This post still applies. Create account API is detached from connector provisioning. If you run a connector aggregation, any accounts you create via API may be removed if they don’t exist on the source.

1 Like
15

Thank you so much Colin for clarification

16

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.