Yes, the /cc API isn’t documented as it is meant for internal use only. However, there is no equivalent public API for inviting users, so we have to use it for now. I went ahead and created an idea in our developer ideas portal at https://developer-sailpoint.ideas.aha.io/ideas/API-I-11. Please give it an upvote when you get a chance.
Unfortunately, I don’t think it’s possible to send an invite to a new identity’s personal/alternate email address via the API. When you trigger a manual invite, either via the UI or the API, it only sends to the primary email address.
That being said, I was able to reverse engineer what the IDN UI is doing to invite users by using my browser inspector and inspecting the API call it makes. /cc/api/users/invite takes a form-data request body. Here’s some example code in a couple of languages so you can see how to do it:
curl
curl --location --request POST 'https://{org}.api.identitynow.com/cc/api/user/invite' \
--header 'Authorization: Bearer {your access token}' \
--form 'ids="1797782"' \
--form 'ids="1675056"'
python
import requests
url = "https://{org}.api.identitynow.com/cc/api/user/invite"
payload={'ids': '1797782',
'ids': '1675056'}
files=[
]
headers = {
'Authorization': 'Bearer {your access token}'
}
response = requests.request("POST", url, headers=headers, data=payload, files=files)
print(response.text)
You’ll notice that the user IDs you provide in the request body aren’t the same IDs you will receive from the Identity Created event trigger. In order to convert the ID from the event trigger into something /cc/api/users/invite will understand you need to use the following request:
GET /cc/api/user/list
This will return a body like this:
{
"total": 11,
"items": [
{
"id": "201783",
"name": "John Doe",
"displayName": "john.doe",
"alias": "john.doe",
"email": "[email protected]",
"status": "ACTIVE",
"enabled": true,
"pending": false,
"externalId": "2c91808375c8e80a01b5e1f38a575221",
"processingDetails": null
},
{
"id": "201766",
"name": "Jane Gray",
"displayName": "jane.gray",
"alias": "jane.gray",
"email": "[email protected]",
"status": "UNREGISTERED",
"enabled": true,
"pending": false,
"externalId": "2c01808475b4334aa875e1e004d463ff",
"processingDetails": null
},
...
]
}
If you have more than 250 users (the max number of users per API call), you will have to use pagination to get the full list. For example GET /cc/api/user/list?start=0&limit=250 will return the first 250 users, and /cc/api/user/list?start=1&limit=250 will return the next 250 users.
To put it all together, you will need to monitor the Identity Created event trigger for new users joining your organization. For each event you receive, you will need to compare the ID from the event to the externalId from /cc/api/user/list until you find a match, paginating through the results if necessary. Once you find a match, get the short id and use that in your request body to /cc/api/user/invite.
However, this will only send to the primary email address. Please upvote the idea I created so we can have our product team address this issue.
.