NERM advanced search API

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

I am using a REST API action in an update workflow to retrieve another profile.
The API call is an advanced search request with the following body:

{
    "advanced_search": {
      "label": "string",
      "condition_rules_attributes": [
        {
          "type": "ProfileTypeRule",
          "comparison_operator": "==",
          "value": "a90fa6ec-c64f-4218-b720-86aecb3fe90f"
        },
        {
          "type": "ProfileStatusRule",
          "comparison_operator": "==",
          "value": "Active"
        },
        {
            "type": "ProfileAttributeRule",
            "condition_object_type": "ProfileSearchAttribute",
            "condition_object_id": "62df1416-71b7-4e87-8aa5-e92772b56c27",
            "comparison_operator": "include?",
            "value": "{{attribute.organization_profile}}"
          },
            {
          "type": "ProfileAttributeRule",
          "condition_object_type": "ProfileSearchAttribute",
          "condition_object_id": "aa97b24e-790d-4bde-966e-c82b5ccd30f1",
          "comparison_operator": "include?",
          "value": "{{attribute.collaborator_profile}}"
        },
          {
            "type": "ProfileAttributeRule",
            "condition_object_type": "ProfileSelectAttribute",
            "condition_object_id": "fd483f84-3ec6-4605-8e60-e0bfff640302",
            "comparison_operator": "include?",
            "value": "{{attribute.employee_ne_attribute}}"
          }
      ]
    }
  }

The values are retrieved from the workflow session call

{
  "workflow_session": {
    "workflow_id": "4489f9c9-6581-4fb0-9078-1c60728999fb",
    "requester_id": "dc23045e-934b-4d16-8262-1c2017fe5963",
    "requester_type": "User",
    "profile_id": "a3be8c81-c84f-489c-a76c-e81965e8f0df",
    "attributes": {
      "employee_ne_attribute": "b3be8c81-c84f-409c-a76c-e81965e8f2df",
      "organization_profile":"7a8613f4-0ac3-4b98-b847-dc8506fcc1e8",
      "collaborator_profile":"7d37ff34-90f0-4d4d-ae35-b369f74ca29a"
    }
  }
}

However, I am receiving a 500 Internal Server Error for the REST API action within the workflow.
Could there be an issue with the request body?

2

If I had to guess you passing in a string value and not the sys ID. But it will all depend on the type the attribute your trying to search is. If the attribute you are looking at is a reference then you will want to pass the sys_id of the object your look at and not the human friendly name.

The only way to know for sure is to look at each attribute you are passing to see what type it is set to. If it is a text field then what you have should work. But it is a look up attribute you will need the sys_id of the object.

3

All the attributes I m passing are ProfileSearchAttribute or ProfileSelectAttribute , So I’m passing the sys IDs but it doesn’t work

4

Have you tried sending the payload in PostMan with hard coding the values?

I find this method very handy for complex Advanced Searches like what you have out lined here. This way you have something to cross reference while building you workflow. This allows for you to confirm that your attributes are pointed correctly.

5

Yes, I have tried sending the payload in Postman with hardcoded values, and it works fine. However, when using the workflow with variables, such as "value": "{{attribute.organization_profile}}", it fails. It seems like the syntax isn’t resolving properly, which might be causing the issue or the syntax is wrong.

6

When you pull back the JSON of the profile in question. Is it attribute or attributes in the response?

I think you need to send attributes.

7

With hard coded values, the JSON response returns a Profile with all its attributes, including the ones we passed in the search

8

I think you need update this to:

{
    "advanced_search": {
      "label": "string",
      "condition_rules_attributes": [
        {
          "type": "ProfileTypeRule",
          "comparison_operator": "==",
          "value": "a90fa6ec-c64f-4218-b720-86aecb3fe90f"
        },
        {
          "type": "ProfileStatusRule",
          "comparison_operator": "==",
          "value": "Active"
        },
        {
            "type": "ProfileAttributeRule",
            "condition_object_type": "ProfileSearchAttribute",
            "condition_object_id": "62df1416-71b7-4e87-8aa5-e92772b56c27",
            "comparison_operator": "include?",
            "value": "{{attributes.organization_profile}}"
          },
            {
          "type": "ProfileAttributeRule",
          "condition_object_type": "ProfileSearchAttribute",
          "condition_object_id": "aa97b24e-790d-4bde-966e-c82b5ccd30f1",
          "comparison_operator": "include?",
          "value": "{{attributes.collaborator_profile}}"
        },
          {
            "type": "ProfileAttributeRule",
            "condition_object_type": "ProfileSelectAttribute",
            "condition_object_id": "fd483f84-3ec6-4605-8e60-e0bfff640302",
            "comparison_operator": "include?",
            "value": "{{attributes.employee_ne_attribute}}"
          }
      ]
    }
  }
9

If anyone faces the same problem, here is the solution:

If you specify the profile naming differently from the ID, the attribute.organization_profile, for example, will be resolved as the profile name instead of the Sys ID. This causes the search request to fail because these attributes (ProfileSearchAttribute / ProfileSelectAttribute) require a Sys ID as their value.

The solution is to use the ID instead of the profile name, as shown below:

 {
            "type": "ProfileAttributeRule",
            "condition_object_type": "NeAttribute",
            "condition_object_id": "62df1416-71b7-4e87-8aa5-e92772b56c27",
            "comparison_operator": "include?",
            "value": "{{attribute.organization_profile.first.id}}"
          }
1 Like
10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.