How to get flat/expanded Identity + Access data via Search API (like "Include Access Details" report)?

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi everyone,

I’m trying to replicate the “Include Access Details” report via the Search API, but I can’t figure out how to get the data in a flat/expanded format (one row per access item) the same way the UI report generates it.

In the UI, when I download the Identities report with “Include Access Details” enabled, each identity appears multiple times — once per access item (entitlements, roles, access profiles). For example:

Jose | ENTITLEMENT | GR_FINOPS_OCI | OCI

Jose | ENTITLEMENT | OCI_Administrators | OCI

Jose | ROLE | Kit Basico CLT | —

I’m currently using this Search API payload, which works fine for identity attributes:

{

“indices”: [“identities”],

“includeNested”: true,

“query”: {

"query": "attributes.tipoContrato:\\"CLT\\" OR attributes.tipoContrato:\\"PJ\\""

},

“queryResultFilter”: {

"includes": \[

  "attributes.displayName",

  "attributes.email",

  "attributes.login",

  "employeeNumber",

  "attributes.department",

  "access.type",

  "access.name",

  "access.displayName",

  "access.source.name",

  "access.attribute",

  "access.value",

  "access.privileged"

\]

}

}

The problem is that the API always returns the access data as a nested array inside each identity object — not as separate rows. I understand the UI does the “flattening” on its end when generating the CSV.

My questions are:

1. Is there any API parameter or endpoint that returns the data already flat (one row per access item), similar to what the UI report generates?

2. If not, what is the recommended approach to replicate this programmatically? I’m building an automated data pipeline (using Apache Hop) and need to process this efficiently.

I’ve seen some older threads suggesting to process the nested results and flatten them in code, but I wanted to confirm if there’s a more direct API-level solution before going that route.

Thanks in advance!

2

No — SailPoint Search API does not currently support server-side flattening like the “Include Access Details” UI export. The UI internally expands the nested access array before generating CSV.

Recommended approach is exactly what you mentioned: pull identities with includeNested=true and flatten the access[] array in your pipeline (Apache Hop/Spark/Python/etc.) into one row per access item.

3

Hi,

As far as I know, there is no API parameter in SailPoint Identity Security Cloud that returns the access array already flattened the same way the UI “Include Access Details” CSV export does.

The Search API always returns:

  • One identity document

  • With nested access[] objects

The UI/reporting layer performs the flattening client-side before generating the CSV.

So for an automated pipeline (like Apache Hop), the recommended approach is:

  • Use includeNested=true

  • Retrieve the nested access[]

  • Flatten/explode the array in your ETL pipeline

Conceptually:



1 identity × N access items
→ produce N output rows

Your current payload is already close to the correct approach. You just need a transformation step afterward to explode the nested array.

So short answer:

  1. :cross_mark: No known API that returns pre-flattened access rows

  2. :check_mark: Recommended approach = flatten/explode nested access[] programmatically in the pipeline

That’s essentially what the ISC UI export is doing internally as well.