GenAI Descriptions for Entitlements with IIQ8.5

Hello developers,

I am testing functions with IIQ 8.5, and according to the release notes, there is new functionality for GenAI Descriptions for Entitlements on IIQ 8.5. I followed the guide create the OAuth Client Credentials on my dev-rel tenant, and connect with my sandbox IIQ 8.5 instance, the test connection was successfully under the IIQ configuration page, and I can initiate the GenAI Entitlement Descriptions for some entitlements, however, the status just stuck at “Requested”, according to the demo video, it should be updated automatically.

So my questions are:

  1. Any requirement for this setup might be missed here ?
  2. Do we need additional setting on the ISC tenant for this feature?
  3. Do I need to setup any OAuth Client scopes?

Thanks and Regards,

Mike

Hi @mike818148

Please check below settings, you could have selected it.

document for your reference.

8.5_IdentityIQ_AI_Driven_Identity_Security.pdf (1005.1 KB)

Hi Mike,

Good to hear you’ve already set up the OAuth client and verified the connection. Based on the 8.5 documentation, here are a few things to double-check for the GenAI Descriptions for Entitlements feature:

  1. Enable the feature in IIQ

    • Go to Global Settings → AI-Driven Identity Security Configuration and ensure the checkbox Enable GenAI Descriptions for Entitlements is turned on.

    • Review the related options:

      • Enable approvals for GenAI Descriptions for Entitlements – if this is selected but no approver workflow exists, descriptions are automatically approved when submitted
  2. Assign proper capability

    • The requesting user must have the AI Entitlement Description Administrator capability. Without it, requests can get stuck in “Requested” status
  3. Connection details

    • Confirm the GenAI Hostname, Client ID, and Client Secret are correctly configured.

    • Run Test Connection again to ensure IIQ can reach the GenAI API.

    • Adjust Read Timeout and Connection Timeout if necessary

  4. OAuth client in ISC tenant

    • The OAuth client must be created using Client Credentials grant type.

    • Make sure it has the required API scopes for GenAI (these are applied when you generate the client credentials in the tenant).

  5. Process expectations

    • After requesting, the status icon changes as follows:

      • Grey = Requested

      • Purple = Suggested (generated)

      • Yellow = Pending Approval

      • Green = Approved

        If it stays at “Requested” indefinitely, it usually indicates either a misconfigured connection or missing capability/approval workflow.


In short:
Please confirm the capability assignment, that approvals are configured correctly (or disabled), and that your OAuth client in ISC has the right scopes. Most often, a stuck “Requested” status points to approvals not being resolved or a mismatch in the ISC OAuth configuration.

Hope this helps narrow it down!

Hello Pattabhi,

Thanks a lot for your comment, I already disable the approval, and also test connection successfully, but still the issue persisted, and no workflow generated.

Hello Malaranan,

Thanks for your comment, may I ask do you have more details regarding OAuth client required API scopes for GenAI ? I somehow missed that in the documentation.

Thanks and Regards,

MIke

Hi Mike,

Good question , the IdentityIQ 8.5 documentation doesn’t list any special/custom scopes for the GenAI entitlement descriptions. When you create the OAuth client in your ISC tenant, you just need to use the Client Credentials grant type. The generated Client ID/Secret is sufficient for IIQ to call the GenAI APIs once you configure them under Global Settings → AI-Driven Identity Security Configuration.

So in short:

  • No additional API scopes need to be manually selected.

  • Just ensure the client is created with Client Credentials and you use the correct GenAI Hostname, Client ID, and Secret in IIQ.

If scopes were missing, the “Test Connection” in IIQ would fail — since you’re already seeing it succeed, your OAuth client is fine. The stuck “Requested” status is more likely due to approvals/capability setup inside IIQ rather than missing scopes.

Hello,

Thanks a lot.

Turns out there are some error here:

2025-09-18T10:33:25,657 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:138 - Entering getPromptConfiguration(templateName = genai-descriptions-iiq)
2025-09-18T10:33:25,657 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:138 - Entering fetchAndCachePromptConfiguration(artifactName = genai-descriptions-iiq)
2025-09-18T10:33:25,657 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:138 - Entering validateGenAIServiceConfiguration()
2025-09-18T10:33:25,657 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:150 - Exiting validateGenAIServiceConfiguration = null
2025-09-18T10:33:25,658 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:138 - Entering createPromptArtifactFetcherInvocation(artifactName = genai-descriptions-iiq)
2025-09-18T10:33:25,658 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:138 - Entering createGetInvocation(endpoint = v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts)
2025-09-18T10:33:25,752 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:150 - Exiting createGetInvocation = JerseyInvocation [GET https://devrel-ga-14946.api.identitynow-demo.com/v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts]
2025-09-18T10:33:25,752 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:150 - Exiting createPromptArtifactFetcherInvocation = JerseyInvocation [GET https://devrel-ga-14946.api.identitynow-demo.com/v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts]
2025-09-18T10:33:25,752 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:138 - Entering send(invocation = JerseyInvocation [GET https://devrel-ga-14946.api.identitynow-demo.com/v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts])
2025-09-18T10:33:25,753 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:138 - Entering lambda$send$2(invocation = JerseyInvocation [GET https://devrel-ga-14946.api.identitynow-demo.com/v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts])
2025-09-18T10:33:26,131 DEBUG AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:323 - API response status: 404
2025-09-18T10:33:26,131 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:150 - Exiting lambda$send$2 = InboundJaxrsResponse{context=ClientResponse{method=GET, uri=https://devrel-ga-14946.api.identitynow-demo.com/v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts, status=404, reason=Not Found}}
2025-09-18T10:33:26,132 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:138 - Entering lambda$static$5(response = InboundJaxrsResponse{context=ClientResponse{method=GET, uri=https://devrel-ga-14946.api.identitynow-demo.com/v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts, status=404, reason=Not Found}})
2025-09-18T10:33:26,132 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:150 - Exiting lambda$static$5 = false
2025-09-18T10:33:26,132 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:150 - Exiting send = InboundJaxrsResponse{context=ClientResponse{method=GET, uri=https://devrel-ga-14946.api.identitynow-demo.com/v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts, status=404, reason=Not Found}}
2025-09-18T10:33:26,132  INFO AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:175 - Fetched prompt artifact for: genai-descriptions-iiq
2025-09-18T10:33:26,132 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:138 - Entering fetchArtifacts(response = InboundJaxrsResponse{context=ClientResponse{method=GET, uri=https://devrel-ga-14946.api.identitynow-demo.com/v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts, status=404, reason=Not Found}})
2025-09-18T10:33:26,132  INFO AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:41 - Fetching artifacts from response
2025-09-18T10:33:26,133 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:138 - Entering extractZipContents(inputStream = org.glassfish.jersey.apache.connector.ApacheConnector$ConnectionClosingMechanism$1@3f2350c3)
2025-09-18T10:33:26,133 DEBUG AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:62 - Extracting ZIP contents
2025-09-18T10:33:26,133 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:138 - Entering validateZipContents(configJson = null, userPrompt = null)
2025-09-18T10:33:26,133 ERROR AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:122 - Missing required files in ZIP
2025-09-18T10:33:26,160 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:156 - Throwing validateZipContents - java.io.IOException: ZIP file does not contain all required files
2025-09-18T10:33:26,161 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:156 - Throwing extractZipContents - java.io.IOException: ZIP file does not contain all required files
2025-09-18T10:33:26,161 ERROR AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:47 - Error fetching artifacts
java.io.IOException: ZIP file does not contain all required files
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.validateZipContents(GAIEDPromptArtifactFetcher.java:123) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.extractZipContents(GAIEDPromptArtifactFetcher.java:82) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.fetchArtifacts(GAIEDPromptArtifactFetcher.java:43) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDLLMApiService.fetchAndCachePromptConfiguration(GAIEDLLMApiService.java:176) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDLLMApiService.getPromptConfiguration(GAIEDLLMApiService.java:122) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDUtil.fetchPromptConfiguration(GAIEDUtil.java:337) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDSubmissionHandler.submitCreatedRequests(GAIEDSubmissionHandler.java:65) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDAsyncRequestProcessorHandler.submit(GAIEDAsyncRequestProcessorHandler.java:67) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.lambda$submitRequests$0(AsyncRequestProcessor.java:45) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.processRequests(AsyncRequestProcessor.java:85) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.submitRequests(AsyncRequestProcessor.java:45) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.executeOperation(AsyncRequestProcessorSynchronizer.java:164) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.processRequests(AsyncRequestProcessorSynchronizer.java:147) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.run(AsyncRequestProcessorSynchronizer.java:71) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
2025-09-18T10:33:26,189 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDPromptArtifactFetcher:156 - Throwing fetchArtifacts - sailpoint.tools.GeneralException: Error fetching artifacts: ZIP file does not contain all required files
2025-09-18T10:33:26,189 ERROR AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:178 - Error fetching prompt artifact: genai-descriptions-iiq
sailpoint.tools.GeneralException: Error fetching artifacts: ZIP file does not contain all required files
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.fetchArtifacts(GAIEDPromptArtifactFetcher.java:48) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDLLMApiService.fetchAndCachePromptConfiguration(GAIEDLLMApiService.java:176) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDLLMApiService.getPromptConfiguration(GAIEDLLMApiService.java:122) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDUtil.fetchPromptConfiguration(GAIEDUtil.java:337) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDSubmissionHandler.submitCreatedRequests(GAIEDSubmissionHandler.java:65) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDAsyncRequestProcessorHandler.submit(GAIEDAsyncRequestProcessorHandler.java:67) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.lambda$submitRequests$0(AsyncRequestProcessor.java:45) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.processRequests(AsyncRequestProcessor.java:85) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.submitRequests(AsyncRequestProcessor.java:45) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.executeOperation(AsyncRequestProcessorSynchronizer.java:164) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.processRequests(AsyncRequestProcessorSynchronizer.java:147) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.run(AsyncRequestProcessorSynchronizer.java:71) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
Caused by: java.io.IOException: ZIP file does not contain all required files
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.validateZipContents(GAIEDPromptArtifactFetcher.java:123) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.extractZipContents(GAIEDPromptArtifactFetcher.java:82) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.fetchArtifacts(GAIEDPromptArtifactFetcher.java:43) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        ... 11 more
2025-09-18T10:33:26,219 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:156 - Throwing fetchAndCachePromptConfiguration - sailpoint.tools.GeneralException: Error fetching prompt artifact: Error fetching artifacts: ZIP file does not contain all required files
2025-09-18T10:33:26,219 TRACE AsyncRequestSynchronizer service.asyncrequest.gaied.GAIEDLLMApiService:156 - Throwing getPromptConfiguration - sailpoint.tools.GeneralException: Error fetching prompt artifact: Error fetching artifacts: ZIP file does not contain all required files
2025-09-18T10:33:26,220 ERROR AsyncRequestSynchronizer sailpoint.service.asyncrequest.AsyncRequestProcessor:88 - Error processing request type GenAIEntitlementDescription: Error fetching prompt artifact: Error fetching artifacts: ZIP file does not contain all required files
sailpoint.tools.GeneralException: Error fetching prompt artifact: Error fetching artifacts: ZIP file does not contain all required files
        at sailpoint.service.asyncrequest.gaied.GAIEDLLMApiService.fetchAndCachePromptConfiguration(GAIEDLLMApiService.java:179) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDLLMApiService.getPromptConfiguration(GAIEDLLMApiService.java:122) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDUtil.fetchPromptConfiguration(GAIEDUtil.java:337) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDSubmissionHandler.submitCreatedRequests(GAIEDSubmissionHandler.java:65) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDAsyncRequestProcessorHandler.submit(GAIEDAsyncRequestProcessorHandler.java:67) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.lambda$submitRequests$0(AsyncRequestProcessor.java:45) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.processRequests(AsyncRequestProcessor.java:85) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.AsyncRequestProcessor.submitRequests(AsyncRequestProcessor.java:45) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.executeOperation(AsyncRequestProcessorSynchronizer.java:164) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.processRequests(AsyncRequestProcessorSynchronizer.java:147) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.server.AsyncRequestProcessorSynchronizer.run(AsyncRequestProcessorSynchronizer.java:71) [identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
Caused by: sailpoint.tools.GeneralException: Error fetching artifacts: ZIP file does not contain all required files
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.fetchArtifacts(GAIEDPromptArtifactFetcher.java:48) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDLLMApiService.fetchAndCachePromptConfiguration(GAIEDLLMApiService.java:176) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        ... 10 more
Caused by: java.io.IOException: ZIP file does not contain all required files
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.validateZipContents(GAIEDPromptArtifactFetcher.java:123) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.extractZipContents(GAIEDPromptArtifactFetcher.java:82) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDPromptArtifactFetcher.fetchArtifacts(GAIEDPromptArtifactFetcher.java:43) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        at sailpoint.service.asyncrequest.gaied.GAIEDLLMApiService.fetchAndCachePromptConfiguration(GAIEDLLMApiService.java:176) ~[identityiq.jar:8.5 Build fb6698fe9f4-20250709-205815]
        ... 10 more

hum.. need to figure out what’s this ZIP file is ….

In addition, I used postman to query the endpoint, and get response below:

{
    "detailCode": "Not Found",
    "trackingId": "b67b620bd19543cd901ddf9194841e6a",
    "messages": [
        {
            "locale": "en-US",
            "localeOrigin": "DEFAULT",
            "text": "GetLatestApprovelModelArn: prompt not found"
        }
    ]
}

Any idea here?

The 404 + “ZIP file does not contain all required files” means the GenAI prompt artifact (genai-descriptions-iiq) is not deployed in your environment. It’s not bundled by default in IIQ 8.5 — you have to configure GenAI Descriptions for Entitlements first.

Per the 8.5 docs:

  • Go to Global Settings → AI-Driven Identity Security Configuration.

  • Enable GenAI Descriptions for Entitlements.

  • Provide your GenAI hostname, client ID, and client secret (these come from your Identity Security Cloud tenant).

  • Test and save the connection.

You’ll also need to assign the AI Entitlement Description Administrator capability so someone can actually generate descriptions from the Entitlement Catalog page.

Until the GenAI configuration is completed and the artifact is available from your tenant, those API calls will return 404.

1 Like

FYI: I faced the same issue. It looks like in IIQ 8.5 the required GenAI entitlement description bundle (genai-descriptions-iiq) is missing by default, so the system can’t load the prompt configuration and throws the ZIP file error. This is not specific to our setup – it’s happening for everyone. We’ll need a SailPoint patch or hotfix to get the missing artifacts.

1 Like

Hello @malarvanan12,

thanks for the information, have you found any solution here? Does it mean the IIQ 8.5 has a bug or we need to inquiry product team for this feature? And according to what you described, as long as we have the library we no longer need to inquiry ISC on the endpoint: /v2024/genai-gateway/prompts/genai-descriptions-iiq/artifacts ?