Get Identity roles (that meets membership criteria)

Identity Security Cloud (ISC) ISC Discussion and Questions
,
3

Hey Nikesh,

@MattUribe is right. There’s no “given identity X, return all roles whose criteria they’d satisfy” preview API. ISC doesn’t expose the role criteria evaluator as a standalone endpoint. If you want what identity processing actually assigned, read the processed result.

For one identity: GET /v2025/identities/{identityId}/role-assignments

Pass only the identity ID and you get role assignment references, not the full objects. For assigner, source, timestamps, etc., read each one by assignment ID:

GET /v2025/identities/{identityId}/role-assignments/{assignmentId}

Docs: List role assignments, Role assignment details.

For many identities: Hit Search against the identities index and pull roles out of innerHit:

POST /v2025/search?limit=250
Content-Type: application/json

{
  "indices": ["identities"],
  "queryType": "SAILPOINT",
  "query": {
    "query": "id:ef38f94347e94562b5bb8424a56397d8"
  },
  "innerHit": {
    "type": "access",
    "query": "@access.type:ROLE"
  },
  "queryResultFilter": {
    "includes": [
      "id",
      "name",
      "displayName",
      "access.id",
      "access.name",
      "access.type"
    ]
  }
}

For bulk export, query *, page with searchAfter, and map identity IDs to the role inner hits. Criteria-based grants are included because you’re reading effective access from the identity index. Sukanta covered the scalable pattern here: Using /v3/roles endpoint to query criteria covered identity assignments.

If you actually need a “would qualify” preview: No API for it. You would pull the roles with their assignment criteria, pull the identity’s current attributes/accounts/entitlements, and evaluate the criteria tree yourself. Only worth doing for a dry-run or planning use case. For what ISC actually assigned, process the identity and read the role assignments.