Help with Access Request Submission Event Trigger ASYNC Response Issue

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello ISC Experts,

I’m encountering an issue with the Access Request Submission Event Trigger in IdentityNow and could use some guidance. We’ve set up an ASYNC REQUEST_RESPONSE trigger to invoke an External Trigger in a workflow. The workflow executes successfully, but the submitted access request fails with the error: “Error: Please contact your administrator.”

Setup:

Trigger: Access Request Submission (ASYNC mode).
Workflow: Invokes an external endpoint
Documentation followed: Responding to Response Required Triggers | SailPoint Developer Community

Issue:

Per the documentation, the initial response to the trigger invocation should be a 200 OK with an empty JSON object {} within 10 seconds.
When I send {}, I get a Bad Request error from IdentityNow.
As a workaround, I tried including the secret in the body (e.g., {“secret”:“56c98cd9-090f-46dd-a31a-a94556177ce8”}). This allows the initial step to succeed, but the access request still fails with the above error.

Questions:

Has anyone encountered a “Bad Request” when sending an empty JSON {} for the initial acknowledgment? Any suggestions to resolve this?
Is including the secret in the initial response causing the issue, or could the problem lie in the callback response or workflow configuration?

Any known issues with the Access Request Submission trigger in ASYNC mode that might cause this behavior?
I’ve verified the subscription settings (responseDeadline, URL, etc.) and tested the flow in Postman, but I’m still stuck. Any insights or troubleshooting tips would be greatly appreciated!

2

The initial response for ASYNC triggers refers to the response from the webhook endpoint receiving the trigger if you are using an HTTP subscription (vs an Amazon EventBridge subscription). Since you are using Workflows with an External Trigger, the event trigger service will call the workflow external invocation endpoint, which returns this 200 response code.

You only need to send a single request to SailPoint via the $.trigger._metadata.callbackURL when you are approving/denying the request. For example:

{
    "secret": "{{$.trigger._metadata.secret}}",
    "output": {
        "approved": true,
        "approver": "AcmeCorpExternalIntegration",
        "comment": "This access has passed preliminary approval."
    }
}
1 Like
3

Thank you Nathan, appreciate it!

1 Like