Need Guidance on Reporting for Contractor Attestation Workflow in IS

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hello Community,

We have initiated the contractor attestation process in SailPoint ISC using a workflow. Based on attribute‑change detection, a total of 2073 active contractor records were triggered for attestation. Out of these, 1073 attestations have been completed, and the remaining are still in progress.

I am looking for guidance on the reporting side:

  1. Is there a way to generate a report that shows:

    • Which managers have completed their reviews

    • Which managers have not completed their reviews

    • The action taken by each manager (Approve or Deny)

  2. Is there an option to fetch results for multiple workflow executions that were triggered from the same workflow definition?
    Essentially, I need a consolidated report of all workflow runs and their outcomes.

Any suggestions, best practices, or references would be greatly appreciated.

Thank you.

2

Hi Harish!

Not fully out-of-the-box in ISC—you’ll need to pull this via API or reporting export.

What you can get natively

You can see:

Individual workflow executions
Approval status per request

But:

No clean consolidated report across all workflow runs
No built-in view that shows manager + action (approve/deny) + completion status in one place
Correct approach

Use search/reporting via API:

Pull from:
Workflow executions
Access requests / approvals
Correlate:
Manager (approver)
Decision (approve/deny)
Status (completed vs pending)
What you’re trying to build

You’ll need to stitch together:

Completed managers → approvals with decision logged
Pending managers → approvals still in “waiting” state
Actions → approval decision field

3

Hello Harish,

First thing to confirm is where the manager decision is actually happening, since that determines where the data lives.

If your workflow is creating and activating certification campaigns (the common pattern for attribute-change-triggered attestation at this scale), the manager review decisions live in the campaign data, not in workflow execution history. There’s a built-in report that covers exactly what you’re asking for without any API stitching. Go to Admin > Certifications > Campaigns, find your campaign, and select Actions > Download Reports.

Two reports cover your use case:

  • The Campaign Status Report gives you Reviewer, Decision Made (Open, Complete, or Error), Decision (Approve, Revoke, or Acknowledge), Decision Maker, and Decision Date per item. That’s completed vs. pending managers and the action taken, all in one CSV.

  • The Certification Sign Off Report is better for manager-level tracking specifically, showing who has signed off vs. who is still pending.

Both are available for active and completed campaigns, so you don’t need to wait until everything finishes. Regenerate when you need the latest state.

One practical issue at your scale: if the workflow created a separate campaign per contractor identity, the UI download isn’t realistic for consolidating across all of them. In that case, paginate through GET /v3/campaigns to collect campaign IDs, then for each campaign use the flow outlined in this thread:

# Step 1 — Trigger report generation (async, returns 202)
POST /v3/campaigns/{campaignId}/run-report/CAMPAIGN_STATUS_REPORT

# Step 2 — Get campaign reports to find the report ID
GET /v3/campaigns/{campaignId}/reports

# Step 3 — Poll until status is Complete
GET /v3/reports/{reportId}/result

# Step 4 — Download the CSV
GET /v3/reports/{reportId}?fileFormat=csv

Use header Accept: application/csv on step 4. Don’t skip step 3, the generation is async and step 4 will fail if the report isn’t ready yet.

For your second question on workflow execution data, GET /v2025/workflows/{workflowId}/executions lists all runs for a given workflow definition with pagination. Per-run step detail is at GET /v2025/workflow-executions/{executionId}/history-v2. Execution history is only retained for 90 days before archival, so export sooner if you need it.

If the workflow is not launching campaigns and the manager decision is happening inside the workflow as an approval step, the execution API is your source of truth and the campaign reports won’t apply.