Read Workflows API token scope

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I have generated a token from /oauth/token endpoint for my ISC environment and I receive a 200 response and a list of the following scopes applied to the token:

idn:connector-config-lifecycle:read idn:connector-config:read idn:rule-management-connector:read idn:source-checked:read idn:source-unchecked:read idn:sources-admin:read idn:sources:read idn:transform:read sp:connector:read sp:my-personal-access-tokens:manage sp:scopes:default sp:workflow:read

However, using this newly generated token I am unable to hit the GET /v3/workflows API endpoint. Am I missing a scope in the list above? The documentation here says sp:workflow:read should be sufficient: list-workflows | SailPoint Developer Community

2

Hi @dominick-miller ,

Thank you for the question. I took sometime and generated a new PAT with scope “sp:workflow:read” and then submitted the API request (both using V3 and beta) and it looks to be working fine for me.

Can you please try to request for the access token again and then verify the payload if the scopes are correctly mentioned when you generate oAuth token.

You can use the API call https://ORG-NAME.api.identitynow.com/)/oauth/token with below body settings as mentioned in the official documentation Authentication | SailPoint Developer Community

image
image1164Ă—795 84.9 KB

And for your reference i see the below scope along side the token (of course have exclused other details from the response body as it is personnel ).

image

Thank You.
Regards
Vikas.

3

I wonder if an SP Admin has to generate this. This would explain why it worked for you using a PAT. I generated my client credentials using the API management tab.

1 Like
4

Hi @dominick-miller ,

Yes, that makes sense if you generated the credentials using API management tab. I have seen such behavior where client credentials generated via API management does not support all the operations which PAT does. So personally i always prefer PAT.

I believe you can also try to generate the token for yourself. I see in the official documentation it is mentioned that any user can create a token but they can not request permission beyond their user level. So worth giving it a try if reaching out to admin takes more time.

Link to the docuementation → Managing API Keys and Tokens - SailPoint Identity Services

image
image937Ă—296 28.4 KB

Below is the documentation you can use to generated your personnel access token via UI.

These are pretty easy steps, you can go to preferences and then generate the PAT after selecting the proper scope as per your need.

If you find any issues, then org_admin can always generate the token for you while keeping you the owner of the token via API.

If needs more information, please feel free to reach out to me, will be happy to assist. I hope this helps.

Thank You.
Regards
Vikas.

5

Are you able to get a response in Postman using the same access token?

BTW, you can directly use authentication in HTTP Action inside a workflow

image
image961Ă—459 37.3 KB

1 Like
6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.