Need Guidance on Reporting for Contractor Attestation Workflow in IS

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
3

Hello Harish,

First thing to confirm is where the manager decision is actually happening, since that determines where the data lives.

If your workflow is creating and activating certification campaigns (the common pattern for attribute-change-triggered attestation at this scale), the manager review decisions live in the campaign data, not in workflow execution history. There’s a built-in report that covers exactly what you’re asking for without any API stitching. Go to Admin > Certifications > Campaigns, find your campaign, and select Actions > Download Reports.

Two reports cover your use case:

  • The Campaign Status Report gives you Reviewer, Decision Made (Open, Complete, or Error), Decision (Approve, Revoke, or Acknowledge), Decision Maker, and Decision Date per item. That’s completed vs. pending managers and the action taken, all in one CSV.

  • The Certification Sign Off Report is better for manager-level tracking specifically, showing who has signed off vs. who is still pending.

Both are available for active and completed campaigns, so you don’t need to wait until everything finishes. Regenerate when you need the latest state.

One practical issue at your scale: if the workflow created a separate campaign per contractor identity, the UI download isn’t realistic for consolidating across all of them. In that case, paginate through GET /v3/campaigns to collect campaign IDs, then for each campaign use the flow outlined in this thread:

# Step 1 — Trigger report generation (async, returns 202)
POST /v3/campaigns/{campaignId}/run-report/CAMPAIGN_STATUS_REPORT

# Step 2 — Get campaign reports to find the report ID
GET /v3/campaigns/{campaignId}/reports

# Step 3 — Poll until status is Complete
GET /v3/reports/{reportId}/result

# Step 4 — Download the CSV
GET /v3/reports/{reportId}?fileFormat=csv

Use header Accept: application/csv on step 4. Don’t skip step 3, the generation is async and step 4 will fail if the report isn’t ready yet.

For your second question on workflow execution data, GET /v2025/workflows/{workflowId}/executions lists all runs for a given workflow definition with pagination. Per-run step detail is at GET /v2025/workflow-executions/{executionId}/history-v2. Execution history is only retained for 90 days before archival, so export sooner if you need it.

If the workflow is not launching campaigns and the manager decision is happening inside the workflow as an approval step, the execution API is your source of truth and the campaign reports won’t apply.