Create and update accounts and identities in Sailpoint through sailpoint APi's

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Sailpoint IIQv8.4p3

Hi,

One if our customers is asking for sailpoint API’s to push their data in realtime into sailpoint. They are trying to create 300 to 400 users at a time and want all the JML in sailpoint to be handled through same. Are there any bulk creation/update options through sailpoint API and is there any possible impact on performance because of this approach, please advise.

2

Currently, SailPoint doesn’t support bulk JML triggering directly via native APIs.

To achieve this, you will need to build custom workflows to handle the logic:

Identity Creation: A custom workflow that accepts identity attributes as input parameters to handle bulk provisioning of identities.

JML Events: A custom workflow that takes the desired JML event as an input parameter to trigger your specific business logic.

Both custom workflows can then be triggered externally using the out-of-the-box Launch Workflow API.

3

Hello Himabindu. IIQ 8.4p3 supports this through its SCIM APIs. You can create and update identities using POST /identityiq/scim/v2/Users and PUT /Users/{id}, and the Accounts API provides create/update operations for application accounts as well.

For a proper JML setup, though, it might be worth considering making the external HR system an authoritative application and letting IIQ handle identity creation and updates through aggregation. That way the HR system stays the source of truth, and the normal aggregation → Identity Refresh → configured Lifecycle Event flow takes care of joiners, movers, and leavers.

If the customer needs to push data through APIs instead, direct SCIM identity updates work too. IIQ creates an IdentityArchive during SCIM updates by default so that Lifecycle Events can access the identity’s previous values.

You could also create a custom workflow to handle the aggregation and refresh processing, and trigger it through POST /identityiq/scim/v2/LaunchedWorkflows whenever new data comes in.

4

Hi @himabindu306

You can use the SCIM APIs for identity creation and updates, then trigger a custom workflow through the Launch Workflow API to execute Identity Refresh or the required JML logic. This keeps the JML processing inside IIQ instead of moving that logic to the external application.

For handling 300–400 users, I’d also be interested to know if anyone has tested this approach in production. Did you process the requests in batches, or were they sent concurrently? It would be helpful to understand the performance impact and how it compares with using an authoritative source and aggregation.

5

Hi @himabindu306 you can use this http://localhost:8080/identityiq/scim/v2/LaunchedWorkflows API by passing the out-of-the-box (OOTB) or enhanced workflow to create identities, the “LCM Create and Update” workflow will take care of everything.

Thanks,

PVR.

6

Does Identity creation through API"s involve correlation, where based on criteria existing identity can be updated instead of creating new one? and also want to know the impact of multiple API’s calls on the Sailpoint system as the user volume is huge.

7

If an identity exists, it won’t create a new one until you implement the following, if the same first name and last name are used, increment the identity name by one, otherwise, it will be corelated to the existing identity. I don’t think it would be a problem if you use the load balancer to call the API.

8

Dear Venkateswar,

We need to correlate based on a unique field if the user already exists, so can we define that correlation through API call as well?

9

Since you are calling the workflow using the SCIM API, you can do the correlation in a workflow specific attribute, however, that is an enhancement, as there is no OOTB (out-of-the-box) correlation functionality in this workflow.

10

Yes, IdentityIQ 8.4p3 supports creating and updating identities through the SCIM REST APIs (/Users).

  • There is no standard bulk user creation API in IdentityIQ SCIM.
  • For 300-400 users, use:
    • SCIM API calls in controlled batches, or
    • A custom bulk API/plugin if this is a frequent use case.
  • JML processing can be triggered through workflows, lifecycle events, provisioning policies, and role assignments.
  • Performance impact depends on the complexity of provisioning, workflows, rules, approvals, and target system integrations.
  • Recommendation: Perform load testing and process users in batches rather than sending hundreds of requests simultaneously.

Recommended approach: Use SCIM APIs with batch processing or build a custom bulk API/workflow if high-volume real-time onboarding is a recurring requirement.

11

@himabindu306 You can either use SCIM APIs or built your own REST APIs to handle account creation. Is it just a one time activity or they want to keep this APIs as a regular integration to push users from their app to iiq?