Perform Search API - How to filter and get a specific "accounts" from an Identity?

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hey friends!

I’m trying to filter some search results, I already got the Identity that I wanted, but just wanna one specific account from this Identity, my main reason for this search is get some information from this specific account, but I tried to use filter without success… and someone give me a tip?

Search Payload

{
    "indices": [
        "identities"
    ],
    "query": {
        "query": "11111111111",
        "fields": [
            "attributes.cpf"
        ]
    },
    "queryResultFilter": {
        "includes": [
            "id",
            "attributes.cpf",
            "accounts.name",
            "accounts.accountId",
            "accounts.source.name"
        ]
    },
    "filters": {
        "source.name": {
            "type": "TERMS",
            "terms": [
                "UMBRELLA"
            ],
            "exclude": true
        }
    }
}

Result that I got…

[
    {
        "attributes": {
            "cpf": "11111111111"
        },
        "id": "9aa8ed4e1aee429e98dd354c0a0fc6af",
        "accounts": [
            {
                "accountId": "11111111111",
                "name": "USER.LOGIN",
                "source": {
                    "name": "UMBRELLA"
                }
            },
            {
                "accountId": "000000",
                "name": "NAME OF USER",
                "source": {
                    "name": "SAP Success Factors"
                }
            },
            {
                "accountId": "NAME OF USER",
                "name": "NAME OF USER",
                "source": {
                    "name": "IdentityNow"
                }
            }
        ],
        "_type": "identity",
        "type": "identity",
        "_version": "v7"
    }
]

Result that I expect…

[
    {
        "attributes": {
            "cpf": "11111111111"
        },
        "id": "9aa8ed4e1aee429e98dd354c0a0fc6af",
        "accounts": [
            {
                "accountId": "11111111111",
                "name": "USER.LOGIN",
                "source": {
                    "name": "UMBRELLA"
                }
            }
        ],
        "_type": "identity",
        "type": "identity",
        "_version": "v7"
    }
]
2

Hi Leonardo,

Can you try below search payload -

{
    "indices": [
        "identities"
    ],
    "query": {
        "query": "@accounts(name:\"USER.LOGIN\")", 
        "innerHit": {
            "query": "source.name:\"UMBRELLA\"",
            "type": "accounts"
        }
    }
}

Hope it helps.

Thanks,
Shailee

3

Hey @shaileeM,

I try your suggestion but it seems to be similar to mine query using “innerHit”, I already had tested “innerHit” but its seems when I use “inner Hit” the “query Result Filter” is ignored and I can’t choose witch fields return… In my mind I wanted a clean response only with “cpf” and “login” from the specific source… the data returned from your query solves my problem but as I said… innerHit disable the possibility to remove fields from response :frowning:

4

Hey Leonardo. You can’t limit the result to a single account. The includes option will just limit which fields are returned, not which objects are returned. So the behavior you are observing with includes is expected and as close as search alone will get you to your expected result. If you really want to modify the response to contain just the one account you are looking for, you will need some sort of post-processing script to remove the non-related accounts.

5

Yes, when I tested innerHit with trying to restrict attributes in the result, it didn’t work too.
I don’t think currently it possible to control/restrict via API. You will need to process the API response as per your needs via a separate script.

6

Check out this video where I demonstrate advanced reporting techniques using the SDK. I think it will help you develop a script to get the exact data you are looking for.

1 Like
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.