Get Parent Entitlements Using API

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I am looking to retrieve all parent entitlements for an Active Directory group / entitlement.

I tried the Search endpoint (/v3/Search) with “indices” = “entitlements” and with and without “includeNested” specified

This is what the parent entitlements tab on an entitlement look like in the UI. These are the entitlements I’m looking to retrevive

2

Hey @blanghals,
Thank you for posting your first question. We will look into this and circle back with some insights on this for you soon.

3

Hi @blanghals,

Our beta and v3 APIs don’t support entitlements at this time. I also checked our search documentation regarding entitlements and I could not find a way to get parents from search. I inspected my browser to see what IDN uses to get parents, and found that it uses the following:

https://{tenant}.api.identitynow.com/ears/entitlements-v3/entitlements/{entitlementId}/parents

Please give that a try, and if it works, please mark this answer as the solution.

Thank you,
Colin McKibben

4

Hey @blanghals,

I wanted to check in and see if the above was able to work for you. Let us know an update and if we can be of any further assistance to you!

5

@blanghals,

I am marking this thread as resolved. Please let us know if we can assist you any further by commenting below.

6

@colin_mckibben
I am able to use the /ears/entitlements-v3/entitlements API call to get the source entitlements, but only if I use the BEARER token that I capture from the chrome inspect network preview.
If I use the Postman generated token(using client id and client secret) like I do for the V3 and beta API calls, I get a 404 error, and “error”: “Unable to route request”. I’ve tried using the Personal Access Token, and also the Security Settings API management settings.
Does that API call require something else?

Thanks,
Chris

7

@colin_mckibben
I’ve been able to use a different API call to get the entitlements:
https://{{TENANT}}.api.identitynow.com/cc/api/entitlement/list?limit=500&count=true&CISApplicationId={{sourceID}}

Only thing with this, it doesn’t seem to support the normal offset parameter. It does support the limit parameter, but when I use offset, it doesn’t do anything different. Is there any other parameter that I can use to ‘page’ through the results? One of our sources has 34k entitlements!

Thanks,
Chris

8

Try using the start and limit query params. For example, ?limit=500&start=0 should get you the first 500 results, and ?limit=500&start=1 should get you the next page of 500 results.

9

I was just informed that /ears can only be called from the Org Portal or UI generated tokens, so you can’t use PATs or OAuth2 to call /ears. If https://{{TENANT}}.api.identitynow.com/cc/api/entitlement/list?limit=500&count=true&CISApplicationId={{sourceID}} gets you the information you need, then I would stick with that for now. FYI, engineering is working on CRUD endpoints for entitlements to be released this year.

10

@colin_mckibben Thanks, the start did it!
In other API calls, offset is used, so thats what I tried.

11

Update to this thread. There are now beta endpoints for getting parent entitlements.