How can we retrieve historical identity entitlement additions and removals through Data Share or API?

SailPoint Human Fabric (SHF) SHF Discussion and Questions
,
1

Hello all, I use SailPoint Data Share in Snowflake to report identity entitlements. The available identity-entitlement relationship appears to contain only the current state; when access is removed, the relationship disappears.

The Identity History UI shows entitlement additions and removals, but we cannot find the corresponding Data Share table or API.

Is there a supported API, Data Share table, or audit-event type for retrieving historical entitlement grant and removal events, including identity, entitlement, source, action, and timestamp? Can this information be queried incrementally, and what is its retention period?

If this history is not available, is storing periodic snapshots and calculating deltas the recommended approach?

2

Welcome to the Developer Community, Valery.

For Data Share, ACCOUNT_ENTITLEMENTS.DELETED_DATE can be used to identify when an account-entitlement relationship was removed. However, the table does not expose an equivalent grant timestamp, and IDENTITY_HISTORY_EVENTS is documented for identity attribute changes rather than entitlement add/remove history. (SDS data dictionary)

For the actual access history, I would suggest the Identity History API: GET /historical-identities/v1/{id}/events, filtered with accessItemTypes=entitlement and AccessAddedEvent / AccessRemovedEvent. It is experimental and works per identity. (Identity History)

SailPoint also documents AddEntitlement and RemoveEntitlement audit events, which you can query in Search. Audit events are retained for one year plus the current month, with older data available up to five years through an Audit History Request Form, so that may also be worth evaluating for the reporting requirement.

3

Harish, thank you for the help!

4

HI @vstouba,

This seems to be possible to track the historical entitlements/groups addition and removals using Cloud Audit logs. This could be achieved with the help of Data share and the standard APIs. And the same has been explained by Harish. Hope this helps .