# Download, Version, and Update IdentityNow Cloud Rules

**URL:** <https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593>\
**Category:** Community Blog\
**Tags:** rules, sailpoint-identity-security\
**Created:** [July 10, 2023, 7:01am UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593 "2023-07-10T07:01:00Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![anneragh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anneragh/32/8934_2.png) [@anneragh](https://developer.sailpoint.com/discuss/u/anneragh)\
**Post date:** [July 10, 2023, 7:01am UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/1 "2023-07-10T07:01:00Z")

</div>

![](https://global.discourse-cdn.com/sailpoint/original/2X/4/4b63274ab52c74259974d5b092858c8b7be7a73f.png)

 

At the moment, SailPoint IdentityNow doesn’t offer a way to review or download cloud rules within the UI. This can be problematic as it makes it difficult to know what rules are running in your tenant. In this blog, I will demonstrate how to use the SailPoint API to manage your cloud rules. With this approach, you can export all rules in your tenant to your computer, store them in version control, and upload updated rules back into your tenant.

# Download all rules

A script has been developed to export all rules into separate XML files in a chosen folder. This script can be extremely helpful when you need to export and maintain version control on your rules.

## Prerequisites

1. Install the [SailPoint Powershell SDK](https://developer.sailpoint.com/idn/tools/sdk/powershell/)
2. Install Powershell 6.2 or higher (required by the SDK)
3. Obtain a `clientID` and `clientSecret` from a [personal access token](https://developer.sailpoint.com/idn/api/authentication#generate-a-personal-access-token)

## How to execute the script

To call the script from the command line, open your command prompt or Powershell terminal, navigate to the folder where you saved `Export-Rules.ps1`, and run this command:

`.\Export-Rules.ps1 -Path <pathToExport all your rules>`

## How the script works

The Powershell script performs the following actions:

- Get all the rules in your tenant
- For each rule, create a file in the given “path” with the rule code snippet.
- This will export the rules as per the SailPoint file naming conventions.  
`Rule - {type} - {name}.xml`

For more details about how the script works, you can follow along with the comments in the code below.

```powershell
<#  
      .About
        Export rules from the API and store them as Java files. In this script, the PSSailPoint module is only used to extract tokens to inline with other scripts.
		If you want you can just add one more API call to get an access token and remove the dependency
  #>

param(
        [Parameter(Mandatory=$true)][String]$Path
    )
#Import Custom Modules
Import-Module PSSailPoint

#InIt SailPoint IdentityNow Configuration
$PROXY = <proxy>
$env:SAIL_BASE_URL = <BASE_URL>
$env:SAIL_CLIENT_ID = <clientId>
$env:SAIL_CLIENT_SECRET = <clientSecret>

#load the environmental variable to the sailpoint config
$SailpointConfig=Get-DefaultConfiguration
#Get-access token
$TOKEN=Get-IDNAccessToken
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Authorization", "Bearer $TOKEN")
$response = Invoke-RestMethod "$($SailpointConfig.BaseUrl)cc/api/rule/list" -Method 'GET' -Headers $headers -Proxy $POWERSHELL_CONFIG.idn.proxy

if($response -and $response.count -gt 0){
	foreach($rule in $response.items){
		$xmlContent = @"
		<?xml version='1.0' encoding='UTF-8'?>
			<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
				<Rule name="$($rule.name)" type="$($rule.type)">
  				<Description>$($rule.description)</Description>
				<Source><![CDATA[

				$($rule.source)

				]]></Source>
</Rule>
"@
		$fileName="Rule - $($rule.type) - $($rule.name)"+".xml"
		$filePath=$OUTPUT_PATH + $fileName
		if(Test-Path $filePath){
			Remove-Item $filePath
		}
		Add-content -Path $filePath -Value $xmlContent
	}
}

```

[Export-Rules.ps1](https://developer.sailpoint.com/discuss/uploads/short-url/pCGiI4hjhcE4uws3KkBYGU36Zjx.ps1) (1.6 KB)

> Note: I used the SailPoint Powershell module to get an access token to inline with the other scripts that I have in my environment.

# Version control the rules

There are many version control applications available, but one of the most widely used programs is git. If you are new to git, you can [learn more here](https://git-scm.com/).

- Open git bash
- Navigate to the folder that has the exported Java files.

```auto
cd <folder path with all the java files>

```

- Initialize a new Git repo for the first time.

```auto
git init 

```

- To save changes to the git repository, run these commands:

```auto
git add .
git commit -am "Description of what you changed"

```

- If you have a remote repository, you can push your changes to that remote repository with this command:

```auto
git push

```

# Upload rule changes to SailPoint

- Open the folder with all the rules that were exported by the script.
- Open the file you want to modify and make the necessary changes. Make sure you only change the content/code snippet inside the XML element `<source> </source>`.
- Commit your changes in your git repo.
- SailPoint requires that all cloud rules must go through a rule review process with Professional Services. Here is the [process to upload rules to Sailpoint](([https://developer.sailpoint.com/idn/docs/rules/cloud-rules](https://developer.sailpoint.com/idn/docs/rules/cloud-rules)) and the best practices to follow.
- Once the rule(s) are uploaded, you can repeat the process to pull the files.

---

<div class="post-metadata">

**Author:** ![sharvari](https://avatars.discourse-cdn.com/v4/letter/s/3be4f8/32.png) [@sharvari](https://developer.sailpoint.com/discuss/u/sharvari)\
**Post date:** [July 10, 2023, 4:10pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/4 "2023-07-10T16:10:56Z")

</div>

This is a helpful script. Thanks Raghunath!.

---

<div class="post-metadata">

**Author:** ![smukhija](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/smukhija/32/3759_2.png) [@smukhija](https://developer.sailpoint.com/discuss/u/smukhija)\
**Post date:** [July 10, 2023, 4:15pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/5 "2023-07-10T16:15:10Z")

</div>

The script is really useful for downloading the rules in a user-friendly readable format and avoid the step to extract rules and unescaping characters

---

<div class="post-metadata">

**Author:** ![anneragh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anneragh/32/8934_2.png) [@anneragh](https://developer.sailpoint.com/discuss/u/anneragh)\
**Post date:** [July 10, 2023, 4:45pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/6 "2023-07-10T16:45:47Z")

</div>

I’m glad to hear that you find it helpful! @sharvari

---

<div class="post-metadata">

**Author:** ![anneragh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anneragh/32/8934_2.png) [@anneragh](https://developer.sailpoint.com/discuss/u/anneragh)\
**Post date:** [July 10, 2023, 4:47pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/7 "2023-07-10T16:47:01Z")

</div>

Thank you, @smukhija! I am pleased to hear that.

---

<div class="post-metadata">

**Author:** ![IAMpdu](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iampdu/32/2671_2.png) [@IAMpdu](https://developer.sailpoint.com/discuss/u/IAMpdu)\
**Post date:** [July 27, 2023, 4:17pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/8 "2023-07-27T16:17:09Z")

</div>

It is very helpful !! Thanks @anneragh !!

---

<div class="post-metadata">

**Author:** ![anneragh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anneragh/32/8934_2.png) [@anneragh](https://developer.sailpoint.com/discuss/u/anneragh)\
**Post date:** [July 27, 2023, 4:31pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/9 "2023-07-27T16:31:59Z")

</div>

I’m glad to hear that you find it helpful! @IAMpdu

---

<div class="post-metadata">

**Author:** ![amahmood](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/amahmood/32/3785_2.png) [@amahmood](https://developer.sailpoint.com/discuss/u/amahmood)\
**Post date:** [October 20, 2023, 3:46am UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/10 "2023-10-20T03:46:23Z")

</div>

That’s really useful Raghunath!!

---

<div class="post-metadata">

**Author:** ![jtharbison-slack](https://avatars.discourse-cdn.com/v4/letter/j/e19adc/32.png) [@jtharbison-slack](https://developer.sailpoint.com/discuss/u/jtharbison-slack)\
**Post date:** [November 10, 2023, 7:17pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/11 "2023-11-10T19:17:56Z")

</div>

The current version of this script has a couple of issues. First the PSSailPoint module does not have a Get-AccessToken cmdlet and there is a missing " after the “+” and before the “.xml”.

---

<div class="post-metadata">

**Author:** ![anneragh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anneragh/32/8934_2.png) [@anneragh](https://developer.sailpoint.com/discuss/u/anneragh)\
**Post date:** [November 10, 2023, 7:23pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/12 "2023-11-10T19:23:41Z")

</div>

> [@anneragh](#):
>
> `$fileName="Rule - $($rule.type) - $($rule.name)"+".xml"`

Thanks @jtharbison-slack I will update accordingly. When I was posted this Get-AccessToken was part of the SailPoint module - I will check this one.

It seems like the file is missing a quote, but it is available above in the document ($fileName=“Rule - $($rule.type) - $($rule.name)”+“.xml”). I will update it. Thank you for bringing this to my attention.

---

<div class="post-metadata">

**Author:** ![sushantkulkarni](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sushantkulkarni/32/35213_2.png) [@sushantkulkarni](https://developer.sailpoint.com/discuss/u/sushantkulkarni)\
**Post date:** [December 14, 2023, 2:12pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/13 "2023-12-14T14:12:23Z")

</div>

@anneragh This is great! I have a quick question: The script uses CC API to get the list of rules. CC APIs are going to go away after March 2024, is that correct? Without that API, can we still be able to use the script?

---

<div class="post-metadata">

**Author:** ![anneragh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anneragh/32/8934_2.png) [@anneragh](https://developer.sailpoint.com/discuss/u/anneragh)\
**Post date:** [December 14, 2023, 2:22pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/14 "2023-12-14T14:22:12Z")

</div>

@sushantkulkarni - Good Question!, I also have a same question. @colin_mckibben - Any insights?

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [December 14, 2023, 9:31pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/15 "2023-12-14T21:31:09Z")

</div>

Short answer: Try using sp config to export your rules.

> **[export-sp-config | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/beta/export-sp-config)**
>
> Initiates configuration objects export job

Long answer: Still waiting for engineering to confirm if /cc/api/rule/list will have a direct public replacement or not. In the meantime, use sp config.

---

<div class="post-metadata">

**Author:** ![anneragh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anneragh/32/8934_2.png) [@anneragh](https://developer.sailpoint.com/discuss/u/anneragh)\
**Post date:** [December 14, 2023, 9:46pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/16 "2023-12-14T21:46:02Z")

</div>

SP-Config only gets the connectors rules. For cloud rules only way is /cc/api/rule/list

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [December 15, 2023, 3:16pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/17 "2023-12-15T15:16:51Z")

</div>

Ah, thanks for pointing that out. I have made a note and will bring this feedback to engineering.

---

<div class="post-metadata">

**Author:** ![mabhavsa](https://avatars.discourse-cdn.com/v4/letter/m/ee59a6/32.png) [@mabhavsa](https://developer.sailpoint.com/discuss/u/mabhavsa)\
**Post date:** [March 20, 2024, 9:28am UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/18 "2024-03-20T09:28:11Z")

</div>

Thanks for sharing this.

---

<div class="post-metadata">

**Author:** ![gkiris1](https://avatars.discourse-cdn.com/v4/letter/g/e47774/32.png) [@gkiris1](https://developer.sailpoint.com/discuss/u/gkiris1)\
**Post date:** [May 20, 2024, 1:41pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/19 "2024-05-20T13:41:42Z")

</div>

Hi Colin,

Is there an update about this topic?

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [May 20, 2024, 1:43pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/20 "2024-05-20T13:43:55Z")

</div>

Yes, the deprecation announcement for /api/rule/list has confirmed that SP config will include cloud rules.

> [@GET /api/rule/list](https://developer.sailpoint.com/discuss/t/get-api-rule-list/28155/15):
>
> @reklawttocs Currently, the VSCode plugin can export all rules through the SPConfig. I have just tested and by selected all rules, cloud rules will also be exported. Actually, I just learned from Colin’s answer that the SPConfig could be leveraged to get the cloud rules. Not sure what I can do more. Cloud rules will not be “editable” as connector rules. Feel free to create an issue as an enhancement request and to write your expectation, expected behavior and all.

---

<div class="post-metadata">

**Author:** ![anneragh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/anneragh/32/8934_2.png) [@anneragh](https://developer.sailpoint.com/discuss/u/anneragh)\
**Post date:** [May 20, 2024, 3:32pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/21 "2024-05-20T15:32:58Z")

</div>

We can deprecate this blog! It was needed when cloud rules were not part of the sp config and we were using CC API.

Now these rules are part of SP-Config.

---

<div class="post-metadata">

**Author:** ![sagar\_kamalakar](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/sagar_kamalakar/32/18893_2.png) [@sagar\_kamalakar](https://developer.sailpoint.com/discuss/u/sagar_kamalakar)\
**Post date:** [November 18, 2024, 6:42pm UTC](https://developer.sailpoint.com/discuss/t/download-version-and-update-identitynow-cloud-rules/13593/24 "2024-11-18T18:42:25Z")

</div>

@anneragh Thanks for your last comment. It saved my time—I was running your script and getting a ‘Service Temporarily Unavailable’ error. cc/api/rule… 🙂