List Pending Certification Items for an identity

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi,

My requirement is to list all pending certification for a user. I am trying below API but its not returning anything though there are pending certification tasks assigned for user.

Can some please check if this API is working fine or am I doing some mistake in calling API?

-Abhinov

2

Hello Abhinov. I think the API is working as designed. /certification-tasks/v1 returns QUEUED or IN_PROGRESS certification processing tasks, not pending certification reviews assigned to a reviewer. Therefore, an empty response can be expected if no such task is currently running. (List of pending certification tasks)

For pending certifications assigned to a user, I would suggest using /certifications/v1

GET /certifications/v1?reviewer-identity={identityId}&filters=completed eq false and phase eq "ACTIVE"

You can also use reviewer-identity=me for the current user. API only returns certifications the calling token is authorized to review. (List identity campaign certifications)

If you need the individual access review items within each pending certification, use:
/certifications/v1/{id}/access-review-items for each returned certification. (List of access review items)

3

What output you are getting after making the request ?

4

Hi @punna0001 ,

Thank you for the API details its working fine. But its only listing the identity campaigns created. The API is not returning if any role composition review is pending for the user.

Is there a way to get role composition review pending for a user.

Thanks,

Abhinov

5

Hi,

It was just returning the empty array.

-Abhinov

6

Hello Abhinov. /certifications/v1 only returns identity campaign certifications, so Role Composition certifications do not show up there. (list-identity-certifications)

The most you can pull today is the campaign itself. Through /campaigns/v1 with detail=FULL, roleCompositionCampaignInfo.reviewer gives the reviewer when a specific identity or governance group was configured. If the campaign uses Role Owner, each role can have a different reviewer, so roleCompositionCampaignInfo.reviewer does not contain a single campaign-level reviewer and cannot tell you which user has each pending review. (list-campaigns)

I do not see an equivalent to /certifications/v1 for listing a user’s pending Role Composition reviews. SailPoint has confirmed this limitation and referenced enhancement request GOV-I-2425. (Get Certification - Role Composition Campaign)

The Work Items API does not fill this gap either, since those items are post-decision remediation tasks, not the pending review itself. (Fetching Remediation comments via API for work items)

So you can identify the campaign and its configured reviewer when one was explicitly set, but you cannot list the individual pending Role Composition reviews for a specific user through the supported public API.