POST /api/source/terminateAggregation

Identity Security Cloud (ISC) Non-Public API Deprecations
1

Replaced by

Specifically, you can update the completionStatus and completed fields to stop a task.

[
  {
    "op": "replace",
    "path": "/completionStatus",
    "value": "Error"
  },
  {
    "op": "replace",
    "path": "/completed",
    "value": "2020-07-11T21:23:15.000Z"
  }
]
2 Likes
2

what should be the Content-Type

image
image2132Ă—1030 151 KB

completedStatus should be error/success to complete this.

3

Hello,

All PATCH method need “application/json-patch+json” content-type, see example on the api doc :smiley:

image
image1358Ă—853 83.3 KB

Have a good day,
Thomas

4

Should customers really have the capability to manually change the completionStatus and the completed date of (these/all) tasks? I would say too much power is given here as this could be considered audit data and this might result in security issues. Just like we shouldn’t be able to change approval statuses during access request and manually change the decision from a manager from deny to approved, or we shouldn’t be able to change the modified or modifiedBy attributes in workflows. To me tasks information is something internally managed that we shouldn’t touch. The fact that we can change all tasks, regardless of type sounds strange to me.

I do see the need to terminate aggregations, but that should preferably be done in a different way. We could for example use an endpoint POST /beta/task-status/:id/terminate or POST /beta/aggregations/terminate?task_id=1234, where the backend server checks if we should be able to terminate these tasks (yes for account/entitlement aggregations, no for tasks that might corrupt objects when terminated or for aggregations that have already finished itself, either in success or error. And only when the server accepts the change, should it change the completionStatus to TERMINATED (not Error) and the completed value should be calculated by the server, not being given by us. And in addition an audit record should be stored (to be found in search) that mentioned who terminated the aggregation.

1 Like
5

that should be true in terms of Auditing.

thanks
osman