JSONPath filter works with hardcoded value, but fails with trigger variable in Workflow HTTP Request body

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi everyone,

I am working on a SailPoint ISC Workflow to remove identities from a role membership list using the /v2025/roles/{id} PATCH API.

The workflow does the following:

  1. External trigger passes the role ID.
  2. Workflow performs a GET on the role.
  3. Workflow PATCHes /membership with the updated IDENTITY_LIST.

Scenario 1: Hardcoded identity ID works

Trigger input:

{
  "id": "89ce9c786c47463ca485b43437f408fa",
  "operation": "Modify"
}

PATCH body expression:

[
  {
    "op": "replace",
    "path": "/membership",
    "value": {
      "type": "IDENTITY_LIST",
      "identities": [{{$.hTTPRequest.body.membership.identities[?(@.id != '12a8a56944974c218d16b3da56233673')].JSON()}}]
    }
  }
]

This works. The evaluated HTTP request body becomes:

[
  {
    "op": "replace",
    "path": "/membership",
    "value": {
      "identities": [
        {
          "aliasName": "gargi.agrawal",
          "id": "305408dd020747e38adf40c11cf05d33",
          "name": "gargi.agrawal",
          "type": "IDENTITY"
        }
      ],
      "type": "IDENTITY_LIST"
    }
  }
]

The PATCH succeeds with statusCode: 200, and the role membership is updated correctly.

Scenario 2: Using trigger variable fails

Now I want to pass the identity ID dynamically in the trigger.

Trigger input:

{
  "id": "89ce9c786c47463ca485b43437f408fa",
  "memberid": "12a8a56944974c218d16b3da56233673",
  "operation": "Modify"
}

PATCH body expression:

[
  {
    "op": "replace",
    "path": "/membership",
    "value": {
      "type": "IDENTITY_LIST",
      "identities": [{{$.hTTPRequest.body.membership.identities[?(@.id != '{{$.trigger.memberid}}')].JSON()}}]
    }
  }
]

This fails with:

Unable to parse input as JSON, please ensure it is syntactically correct.
(type: Error Parsing Input, retryable: false): invalid character '{' looking for beginning of object key string

I also tried using the trigger value directly inside the JSONPath predicate:

{{$.hTTPRequest.body.membership.identities[?(@.id != $.trigger.memberid)].JSON()}}

But that does not filter the array correctly. It returns the original identities array unchanged.

Question

Does SailPoint Workflow support referencing trigger variables inside JSONPath filter predicates like this?

[?(@.id != $.trigger.memberid)]

or is only a hardcoded literal supported inside [?()]?

If dynamic variables are not supported inside JSONPath predicates, what is the recommended native Workflow approach to remove one or more identities from a role membership list when the trigger only provides the member IDs to remove?

I cannot use an external API/service for filtering, and I do not have a Script operator available.

2

Hi @RadhikaM ,

From what I’ve seen, Workflow JSONPath filters don’t support injecting workflow variables inside the predicate expression. That’s why a hardcoded value works:

[?(@.id != '12a8a56944974c218d16b3da56233673')]

but using:

[?(@.id != $.trigger.memberid)]

or nesting {{ }} inside the predicate either fails to parse or doesn’t evaluate as expected.

The error you’re seeing is caused by the workflow trying to resolve the template expression inside a JSONPath filter, which isn’t supported.

If Script is not available, the native approach would be to:

  1. GET the role membership.
  2. Loop through the identities.
  3. Build a new list excluding the member ID passed in the trigger.
  4. PATCH the role with the filtered membership list.

Unfortunately, Workflow JSONPath filtering is fairly limited and dynamic variables inside [?()] predicates are not reliably supported today.

You could also consider using the Role Membership APIs (if applicable to your use case) instead of replacing the entire membership list, as that avoids having to perform the filtering yourself.

Thanks.

3

If the following does not work, then you can use a loop to loop through the items and skip the patch where the id matches the member id from trigger

[
{
“op”: “replace”,
“path”: “/membership”,
“value”: {
“type”: “IDENTITY_LIST”,
“identities”: [{{$.hTTPRequest.body.membership.identities[?(@.id != {{$.trigger.memberid}})].JSON()}}]
}
}
]