# ISC Workflow - Grant access only until a fixed expiryDate after delayed approval

**URL:** <https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312>\
**Category:** SHF Discussion and Questions\
**Tags:** workflows, access-requests, sailpoint-identity-security\
**Created:** [June 22, 2026, 5:35am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312 "2026-06-22T05:35:23Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![RadhikaM](https://avatars.discourse-cdn.com/v4/letter/r/ee7513/32.png) [@RadhikaM](https://developer.sailpoint.com/discuss/u/RadhikaM)\
**Post date:** [June 22, 2026, 5:35am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312/1 "2026-06-22T05:35:24Z")

</div>

I’m building an access workflow in SailPoint ISC and have a requirement where the access duration should be based on the **remaining time until a predefined expiry date** , not a fixed duration from the time the role is granted.

### Example

The external trigger sends the following payload:

```auto
{

  "identity": "john.doe",
  "roleID": "cb4f5634cc7d488b8a4528c4b9e92957",
  "startDate": "2026-06-19T10:30:00Z",
  "expiryDate": "2026-06-19T11:30:00Z",
  "expiry": "1h"
}

```

The workflow raises an approval. The problem is that the approval may not be completed immediately.

For example:

- Request submitted: **10:30**

- Approval completed: **11:00**

- Expiry date: **11:30**

In this case, I want the role to be assigned for **only the remaining 30 minutes** , not for the original 1 hour.

Currently, `sp:access:manage` only accepts a fixed `removeDuration`, for example:

```auto
"removeDuration.$": "$.trigger.expiry"

```

### My questions

1. Is there any supported way in ISC Workflow to calculate:

2. Although JSONPath provides `$.now()`, I couldn’t find any built-in function for date/time arithmetic. Is there an ISC-supported approach for this?

3. Has anyone implemented this requirement without using an external API?

4. Is the recommended approach instead to:

I’d appreciate any guidance or examples from anyone who has implemented JIT access with approval delays.

---

<div class="post-metadata">

**Author:** ![Gopi2000](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gopi2000/32/21706_2.png) [@Gopi2000](https://developer.sailpoint.com/discuss/u/Gopi2000)\
**Post date:** [June 22, 2026, 6:03am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312/2 "2026-06-22T06:03:59Z")

</div>

Hi @RadhikaM

The recommended approach would be to grant the role after approval without a `removeDuration`, then use a **Wait Until** step based on the `expiryDate` and perform a second `sp:access:manage` action to revoke the role. This ensures the access expires at the intended absolute time regardless of approval delays.

---

<div class="post-metadata">

**Author:** ![RadhikaM](https://avatars.discourse-cdn.com/v4/letter/r/ee7513/32.png) [@RadhikaM](https://developer.sailpoint.com/discuss/u/RadhikaM)\
**Post date:** [June 22, 2026, 6:18am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312/3 "2026-06-22T06:18:45Z")

</div>

What if the expiry date gap is 4 to 5 days? Each trigger of the workflow will run for 4-5 days. Is that a good idea?

---

<div class="post-metadata">

**Author:** ![Gopi2000](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gopi2000/32/21706_2.png) [@Gopi2000](https://developer.sailpoint.com/discuss/u/Gopi2000)\
**Post date:** [June 22, 2026, 7:57am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312/4 "2026-06-22T07:57:48Z")

</div>

That’s a good point. For expiry periods of 4–5 days, each workflow instance would remain active until the access is revoked.

---

<div class="post-metadata">

**Author:** ![RAKRHEEM](https://avatars.discourse-cdn.com/v4/letter/r/f05b48/32.png) [@RAKRHEEM](https://developer.sailpoint.com/discuss/u/RAKRHEEM)\
**Post date:** [June 23, 2026, 6:59am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312/5 "2026-06-23T06:59:21Z")

</div>

This is not a recommended practice to keep the workflow waiting for 5 days

---

<div class="post-metadata">

**Author:** ![Gopi2000](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gopi2000/32/21706_2.png) [@Gopi2000](https://developer.sailpoint.com/discuss/u/Gopi2000)\
**Post date:** [June 27, 2026, 3:57am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312/6 "2026-06-27T03:57:43Z")

</div>

That’s correct. If possible, you can try rerouting it with a scheduled trigger. Otherwise, this will be the only option.

---

<div class="post-metadata">

**Author:** ![punna0001](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/punna0001/32/42011_2.png) [@punna0001](https://developer.sailpoint.com/discuss/u/punna0001)\
**Post date:** [June 28, 2026, 12:55am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312/7 "2026-06-28T00:55:34Z")

</div>

Hello Radhika,  
Did you happen to look at the [Submit Access Request API](https://developer.sailpoint.com/docs/api/v3/create-access-request/)? It supports a `removeDate` field which takes an absolute UTC timestamp.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/5/3/535bd90389cfa86dd9b53e9d6ce3eb7840ce93fa.png)

So, ISC removes the access at that fixed time regardless of when the approval actually completes.

Instead of the Manage Access action, try using an HTTP Request step after approval and call `POST /v3/access-requests` with your trigger’s `expiryDate` directly as `removeDate`:

```auto
{
  "requestedFor": ["<identityId>"],
  "requestType": "GRANT_ACCESS",
  "requestedItems": [
    {
      "id": "{{$.trigger.roleID}}",
      "type": "ROLE",
      "removeDate": "{{$.trigger.expiryDate}}"
    }
  ]
}

```

That way you don’t need to calculate `expiryDate - now` at all. ISC handles the sunset on its own at that exact time. No duration math, no long running Wait steps, no second revoke call.

I would suggest to add a Compare Dates check after approval to make sure `expiryDate` is still in the future before firing the request. If the approver took too long and the window already passed, the API will reject it since `removeDate` needs to be a future timestamp. Better to catch that early and notify the requester than let it fail silently.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [August 27, 2026, 12:55am UTC](https://developer.sailpoint.com/discuss/t/isc-workflow-grant-access-only-until-a-fixed-expirydate-after-delayed-approval/214312/8 "2026-08-27T00:55:57Z")

</div>

Closed on August 27, 2026, 12:55am UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.