# Get group/entitlement value for create user **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** webservice-connector, provisioning, sailpoint-identity-security\ **Created:** [June 18, 2026, 4:34am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994 "2026-06-18T04:34:57Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Tieasna](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@Tieasna](https://developer.sailpoint.com/discuss/u/Tieasna)\ **Post date:** [June 18, 2026, 4:34am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/1 "2026-06-18T04:34:57Z")
## Hello, We are currently integrating Prisma with sailpoint ISC and we have problem getting group/entitlement ID for body in http request, the requirement for API create operation is getting group/entitlement ID and put in the parameter. The JSON raw structure is currently like this `{` `"accessKeysAllowed": true,` `"defaultRoleId": "string",` `"email": "string",` `"firstName": "string",` `"lastName": "string",` `"roleIds": [` `"string"` `],` `"timeZone": "string"` `}'` defaultRoleId, and roleIds value is the group/entitlement ID that assigned to the user I have been using $plan.groups$ but its not working, any suggestion for this? Thank You ---
**Author:** ![Bapu-Gogu](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/bapu-gogu/32/40049_2.png) [@Bapu-Gogu](https://developer.sailpoint.com/discuss/u/Bapu-Gogu)\ **Post date:** [June 18, 2026, 9:35am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/2 "2026-06-18T09:35:59Z")
Hi If it is not working as expected, then use web service before operation rule to achieve this: 1. Get account requests and attribute requests. 2. Get the requested groups from the attributes request. 3. Get the current create account body. and replace **roleIds** value. 4. Then update body using requestEndPoint. Refer : [Web Services Before Operation Rule](https://documentation.sailpoint.com/connectors/webservices/help/integrating_webservices/beforeoperationrule.html) ---
**Author:** ![trettkowski](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/trettkowski/32/36103_2.png) [@trettkowski](https://developer.sailpoint.com/discuss/u/trettkowski)\ **Post date:** [June 18, 2026, 11:19am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/3 "2026-06-18T11:19:24Z")
Hi @Tieasna The `$plan` variable depends on the naming in your schema. Can you show us what your account and entitlement schema look like? ---
**Author:** ![Tieasna](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@Tieasna](https://developer.sailpoint.com/discuss/u/Tieasna)\ **Post date:** [June 19, 2026, 4:49am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/4 "2026-06-19T04:49:13Z")
Here is my Account and entitlement schema looks ![image](https://global.discourse-cdn.com/sailpoint/original/3X/a/4/a44968e4c933851c6800963b7bb4fe5756d9b678.jpeg) ![image](https://global.discourse-cdn.com/sailpoint/original/3X/b/2/b2c9b0c0d670014d0bc8869cd184ca8ea1f3240f.png) ---
**Author:** ![luckyn](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/luckyn/32/38499_2.png) [@luckyn](https://developer.sailpoint.com/discuss/u/luckyn)\ **Post date:** [June 19, 2026, 6:40am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/5 "2026-06-19T06:40:53Z")
Hi @Tieasna you can use $plan.RoleId$ attribute to retrieve the values in the HTTP operation. ---
**Author:** ![Bapu-Gogu](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/bapu-gogu/32/40049_2.png) [@Bapu-Gogu](https://developer.sailpoint.com/discuss/u/Bapu-Gogu)\ **Post date:** [June 22, 2026, 9:58am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/6 "2026-06-22T09:58:35Z")
Try below: `{` `"accessKeysAllowed": true,` `"defaultRoleId": "string",` `"email": "string",` `"firstName": "string",` `"lastName": "string",` `"roleIds": [` `"$plan.roles$"` `],` `"timeZone": "string"` `}'` ---
**Author:** ![Tieasna](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@Tieasna](https://developer.sailpoint.com/discuss/u/Tieasna)\ **Post date:** [June 22, 2026, 4:06pm UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/7 "2026-06-22T16:06:47Z")
Hello, it’s not working, it send no value ---
**Author:** ![RAKRHEEM](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@RAKRHEEM](https://developer.sailpoint.com/discuss/u/RAKRHEEM)\ **Post date:** [June 23, 2026, 5:25am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/8 "2026-06-23T05:25:52Z")
Please check the box. Create Account with Ent request in Additional Settings. Let me know if it fixes the issue ![17821922707253828887554259153457](https://global.discourse-cdn.com/sailpoint/original/3X/1/d/1dedff8ae02b1771308334b706087009cc511471.png) ---
**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\ **Post date:** [July 4, 2026, 5:32am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/9 "2026-07-04T05:32:10Z")
Hello @Tieasna By default, the Web Services connector creates the account first and then sends entitlement requests separately. SailPoint documents `createAccountWithEntReq` as `false` by default, and says enabling it sends entitlements with the Create Account request in a single call: [Additional Configuration Parameters](https://documentation.sailpoint.com/connectors/webservices/help/integrating_webservices/additional_configuration_parameters.html) So for your case, enable **Create Account with Ent Request** / `createAccountWithEntReq=true`, then use the entitlement attribute name from your schema in the body. Since your entitlement attribute appears to be `RoleId`, test with something like: ```auto "roleIds": [ "$plan.RoleId$" ] ``` This should work for a single role. If you are assigning multiple roles, or Prisma needs a different structure like `defaultRoleId` plus `roleIds`, use a Web Services Before Operation Rule to read the provisioning plan and update the request body before the call is sent. SailPoint’s Before Operation Rule doc confirms the rule receives the `provisioningPlan` and `requestEndPoint`, and can update the HTTP payload: [Before Operation Rule](https://documentation.sailpoint.com/connectors/webservices/help/integrating_webservices/beforeoperationrule.html) So I would do it in this order: 1. Enable `createAccountWithEntReq`. 2. Use `$plan.RoleId$` since that matches your entitlement schema. 3. Use a Before Operation Rule only if you need to reshape the value into `defaultRoleId` / `roleIds` exactly as Prisma expects. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [September 2, 2026, 5:32am UTC](https://developer.sailpoint.com/discuss/t/get-group-entitlement-value-for-create-user/213994/10 "2026-09-02T05:32:20Z")
Closed on September 2, 2026, 5:32am UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.