Get Identity roles (that meets membership criteria)

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

is it possible to get all the roles that meets a certain identities criteria. i want to get the list of roles (via isc api call) that identity processing would ideally identify the role and provisions the assignments.

2

Hi Nikesh.

It sounds like you are looking for a way to review which roles an identity would qualify for, if the identity were processed. This isn’t a simple API call. You will need to pull down all of the roles and evaluate them locally compared to the identity’s current attributes. Then you could output a list of any roles that match. The biggest challenge is the potential complexity of role criteria.

I wish I could give you a quick API request to meet your needs, but this will take some local development and testing, and it’s not a use case I’ve worked on, so I don’t have any code to share.

Matt

3

Hey Nikesh,

@MattUribe is right. There’s no “given identity X, return all roles whose criteria they’d satisfy” preview API. ISC doesn’t expose the role criteria evaluator as a standalone endpoint. If you want what identity processing actually assigned, read the processed result.

For one identity: GET /v2025/identities/{identityId}/role-assignments

Pass only the identity ID and you get role assignment references, not the full objects. For assigner, source, timestamps, etc., read each one by assignment ID:

GET /v2025/identities/{identityId}/role-assignments/{assignmentId}

Docs: List role assignments, Role assignment details.

For many identities: Hit Search against the identities index and pull roles out of innerHit:

POST /v2025/search?limit=250
Content-Type: application/json

{
  "indices": ["identities"],
  "queryType": "SAILPOINT",
  "query": {
    "query": "id:ef38f94347e94562b5bb8424a56397d8"
  },
  "innerHit": {
    "type": "access",
    "query": "@access.type:ROLE"
  },
  "queryResultFilter": {
    "includes": [
      "id",
      "name",
      "displayName",
      "access.id",
      "access.name",
      "access.type"
    ]
  }
}

For bulk export, query *, page with searchAfter, and map identity IDs to the role inner hits. Criteria-based grants are included because you’re reading effective access from the identity index. Sukanta covered the scalable pattern here: Using /v3/roles endpoint to query criteria covered identity assignments.

If you actually need a “would qualify” preview: No API for it. You would pull the roles with their assignment criteria, pull the identity’s current attributes/accounts/entitlements, and evaluate the criteria tree yourself. Only worth doing for a dry-run or planning use case. For what ISC actually assigned, process the identity and read the role assignments.

4

The approach that @punna0001 describes could work - If I’m understanding correctly:

  1. pull the roles and break down the criteria
  2. use the criteria from each role to perform a search:
    <roleCriteria> AND attributes.uid:<identity’s uid>
  3. Repeat #2 for each role and return the results

Something else that may be useful - I just remembered that there is a community tool provided by @ethompson during Developer Days 2024 that previews role changes using a PowerShell script. You can find the post here:

Hopefully that helps.

Matt

5

GET /v2025/identities/{identityId}/role-assignments could also technically work. it looks like once the identity processing is complete, get role assignments does return all the ‘identified’ roles that user meets the criteria for. even if the entitlements within the role might have not been assigned on the source level. @MattUribe @punna0001

Thanks

6

Yes, once the identity processing is complete. I thought you were looking for a way to determine what roles would apply if processing were completed - like a preview. /v2025/identities/:identityId/role-assignments is definitely not a preview.