How to get account activity via API

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi All,

I want to get all the account activity for a specific identity, trying with below API but it is not giving the correct results. Can someone please correct me over here?

API:-

@colin_mckibben, hope you are well, can you please help me with correct API.

2

Hi @maheshtare,

You can use search enpoint search-post | SailPoint Developer Community.

Post on : https://{{tenant}}.api.identitynow.com/v3/search

With following body :

{
    "query": {
        "query": "*"
    },
    "indices": [
        "accountactivities"
    ],
    "sort": [
        "-modified"
    ]
}
3

Hi @baoussounda,

Thanks for the prompt response. It solves my original ask but is there a way I can get only failed account Activities for a specific source. I have modified your body to get the results for a specific source but looking for only failed account activities so that I can re-trigger it.

{
    "query": {
        "query": "source.id.3fba57ef93af4e28a05dccbe4d123813"
    },
    "indices": [
        "accountactivities"
    ],
    "sort": [
        "-modified"
    ]
}
1 Like
4

@maheshtare right.

In the query i put * for all but you can update as you want the query as specified in the search documentation. For example you can give only activities of last 24 hours or more complex query.

5

@maheshtare if you want to filter acccount activities by source :

{
    "query": {
        "query": "sources:\"YoursourceName\""
    },
    "indices": [
        "accountactivities"
    ],
    "sort": [
        "-modified"
    ]
}

If you want to filter by status :

{
  "query": {
    "query": "status:Complete"
  },
  "indices": [
    "accountactivities"
  ],
  "sort": [
    "-modified"
  ]
}

You can combine this two condition in query :

{
  "query": {
    "query": "sources:\"YoursourceName\" AND status:Complete"
  },
  "indices": [
    "accountactivities"
  ],
  "sort": [
    "-modified"
  ]
}

You can replace status value “complete” by failed status : “Failed” or “Error”

As alternate i also see this endpoint : list-account-activities | SailPoint Developer Community

1 Like
6

Hi @baoussounda,

Thanks for the help. I am able to get the results what I was looking for.

But can you please help me on one more item:

  • We are using ServiceDesk Integration to create tickets for revocations happened during the certification campaign. Ticket creation is working fine untill couple of days back but it failed due to connectivity issue between SailPoint & ServiceNow. How to re-trigger it?

I was thinking to use above APIs to get the failed events for a source and submit the access requests via API. Is there any other way apart from this?

One problem with Access Request API is, we can’t set the requester details through it.

Can you please help.

7

@maheshtare ,

Did you resolved ServiceNow&Sailpoint connectivity issue ? i see many post that and it’s seems like the password it reset on configuration
I see your other post on this subject and i will respond you on that post.

8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.