# Filter access request decision

**URL:** <https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789>\
**Category:** SHF Discussion and Questions\
**Tags:** access-requests, workflows, identity-security-cloud\
**Created:** [April 12, 2024, 6:50am UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789 "2024-04-12T06:50:18Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![gvscdeep1](https://avatars.discourse-cdn.com/v4/letter/g/f05b48/32.png) [@gvscdeep1](https://developer.sailpoint.com/discuss/u/gvscdeep1)\
**Post date:** [April 12, 2024, 6:50am UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789/1 "2024-04-12T06:50:18Z")

</div>

Hi All,

We are trying to create a workflow to existing access profiles on an application if someone has requested for an access profile on the same application. The reason behind this being users should only have one group at once.

I am trying to filter out the access requests from access request decision based on the name of access profile, if the request has been approved and if the type of access request is access profile. Is this scenario directly possible in filter section or should I further be using the loop + compare strings?

---

<div class="post-metadata">

**Author:** ![tushar9625257](https://avatars.discourse-cdn.com/v4/letter/t/b2d939/32.png) [@tushar9625257](https://developer.sailpoint.com/discuss/u/tushar9625257)\
**Post date:** [April 12, 2024, 11:37am UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789/2 "2024-04-12T11:37:33Z")

</div>

Hi Sai,

The best way for this would be to use Segments instead of Workflow, once a user gets an access to end-system, create a custom transform to fetch the user’s access, then under segment you can use a criteria based on the identity attribute and make the access profiles completely invisible to the user so that the user cannot request it at all.

---

<div class="post-metadata">

**Author:** ![gvscdeep1](https://avatars.discourse-cdn.com/v4/letter/g/f05b48/32.png) [@gvscdeep1](https://developer.sailpoint.com/discuss/u/gvscdeep1)\
**Post date:** [April 12, 2024, 3:11pm UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789/3 "2024-04-12T15:11:06Z")

</div>

Hey @tushar9625257

The requirement is that the user should be able to request other groups. But should once they request for it, the previous group should be revoked automatically. So, the segments option would not work unfortunately

---

<div class="post-metadata">

**Author:** ![ipobeidi](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ipobeidi/32/16000_2.png) [@ipobeidi](https://developer.sailpoint.com/discuss/u/ipobeidi)\
**Post date:** [April 12, 2024, 3:57pm UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789/4 "2024-04-12T15:57:11Z")

</div>

hey @gvscdeep1 , how are you?

you can use this trigger to capture the approval decision and them lauch you workflow to remove the access the person have

```auto
{
    "accessRequestId":"4b4d982dddff4267ab12f0f1e72b5a6d",
    "requestedBy":{
        "id":"2c91808b6ef1d43e016efba0ce470906",
        "name":"Adam Admin",
        "type":"IDENTITY"
    },
    "requestedFor":{
        "id":"2c91808b6ef1d43e016efba0ce470909",
        "name":"Ed Engineer",
        "type":"IDENTITY"
    },
    "requestedItemsStatus":[
        {
            "approvalInfo":[
                {
                    "approvalComment":" this is an approval comment",
                    "approvalDecision":"APPROVED",
                    "approver":{
                        "id":"2c91808b6ef1d43d016efba0cf470910",
                        "name":"Stephen Austin",
                        "type":"IDENTITY"
                    },
                    "approverName":"Stephen.Austin"
                }
            ],
            "clientMetadata":{
                "applicationName":"My application"
            },
            "comment":"requester comments",
            "description":"Engineering Access",
            "id":"2a91808b6cf1d43e016efba0cf470904",
            "name":"Engineering Access",
            "operation":"Add",
            "type":"ACCESS_PROFILE"
        }
    ]
}

```

To create the trigger you can so something like this :

```auto
"attributes": {
            "filter.$": "$.accountRequests[?(@.provisioningResult=='SUCCESS' && @.source.name == \"APP\")]",
            "id": "idn:post-provisioning"
        }

```

Let me know the results

---

<div class="post-metadata">

**Author:** ![tushar9625257](https://avatars.discourse-cdn.com/v4/letter/t/b2d939/32.png) [@tushar9625257](https://developer.sailpoint.com/discuss/u/tushar9625257)\
**Post date:** [April 12, 2024, 4:01pm UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789/5 "2024-04-12T16:01:57Z")

</div>

Then you must use a rule, probably the Services Standard Before provisioning rule, it does exactly what you want to do or if you can write a before operation rule if it’s a Web Service application.

---

<div class="post-metadata">

**Author:** ![gvscdeep1](https://avatars.discourse-cdn.com/v4/letter/g/f05b48/32.png) [@gvscdeep1](https://developer.sailpoint.com/discuss/u/gvscdeep1)\
**Post date:** [April 14, 2024, 8:35am UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789/6 "2024-04-14T08:35:15Z")

</div>

Hi @ipobeidi

Thank you for your response. Just to confirm, the filter you mentioned is for “Provisioning Completed” trigger?  
I am trying to use something like $.requestedItemsStatus[?(@.name contains “PRISM” && @.type == “ACCESS\_PROFILE”)] and also check within the filter if is approved or not  
Facing difficulties with it. but trying to set up a compare strings operation to check for the approval status

@tushar9625257, it’s an Entra ID based app, worst case scenarion we shall go with a before prov rule

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [June 4, 2024, 2:53pm UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789/7 "2024-06-04T14:53:21Z")

</div>

A little late to the party, but you might try this filter expression:

`$.requestedItemsStatus[?(@.name contains "PRISM" && @.type == "ACCESS_PROFILE" && @.approvalInfo[*].approvalDecision noneof ['PENDING','REJECTED','EXPIRED','CANCELLED','ARCHIVED'])]`

Since there can be multiple approvers in the approval chain for an access profile, you need the `noneof` to make sure that all of the approval decisions are `APPROVED`. If any single approval decision is not `APPROVED`, then the access wasn’t provisioned.

I used this online tool to validate the JSONpath.

[https://jsonpath.fly.dev/](https://jsonpath.fly.dev/)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [August 3, 2024, 2:53pm UTC](https://developer.sailpoint.com/discuss/t/filter-access-request-decision/44789/8 "2024-08-03T14:53:42Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.