# Remove all entitlements with workflow

**URL:** <https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692>\
**Category:** SHF Discussion and Questions\
**Tags:** workflows, identity-security-cloud\
**Created:** [August 24, 2023, 2:37pm UTC](https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692 "2023-08-24T14:37:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jsosa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jsosa/32/31578_2.png) [@jsosa](https://developer.sailpoint.com/discuss/u/jsosa)\
**Post date:** [August 24, 2023, 2:37pm UTC](https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692/1 "2023-08-24T14:37:38Z")

</div>

Hi, I need to remove all entitlements from some identity. Testing workflow appears to be successful, but entitlements are not removing from identity. I suspect I am not entering the correct json path on Manage Access box.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/7/799f4185f113738e1efa6b53f2bd1d97726d44a5.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/5/51766d82c565e7f2401f8a1acfb71f75f8a62d06.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/e/e104e21f03eee3a1db64a86fd75aed875bfc5de3.png)

As Loop variable $.getAccess.accessItems is mapped to Get Access output, $.loop.loopInput should be right variable input to Manage Access? No errors shown on workflow builder or workflow testing.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/4/4772e82cbfcdf2603d832eb347ef71c572d06c28.png)

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [September 6, 2023, 6:29pm UTC](https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692/2 "2023-09-06T18:29:00Z")

</div>

Hi Julian.

I think your issue is the same as this post. You are not properly referencing the identity ID from the loop context. Please see my reply to this other post on the correct JSONpath. This is assuming the value you put inside your loop context was just the `$` .

> [@Revoking all access based on identity attribute change](https://developer.sailpoint.com/discuss/t/revoking-all-access-based-on-identity-attribute-change/16854/6):
>
> You have the wrong JSONpath for the identity in the Manage Access step inside your loop. You have this: $.trigger.identity.id It should be this: $.loop.context.trigger.identity.id More information on configuring the loop context can be found here: [Operators - SailPoint Identity Services](https://documentation.sailpoint.com/saas/help/workflows/workflow-operators.html#loop)

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [September 19, 2023, 3:08pm UTC](https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692/3 "2023-09-19T15:08:53Z")

</div>

@jsosa were you able to resolve this? If so, what was the issue?

---

<div class="post-metadata">

**Author:** ![jsosa](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jsosa/32/31578_2.png) [@jsosa](https://developer.sailpoint.com/discuss/u/jsosa)\
**Post date:** [September 19, 2023, 5:19pm UTC](https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692/4 "2023-09-19T17:19:26Z")

</div>

Hi Colin, sorry I forgot to return here. I was not able to get objective using the Get Access / Manage Access actions. Instead I replaced the Get Access with a HTTP action, calling the search api to find user entitlements, and then replaced Manage Access action with another HTTP action, this time removing each entitlement as a request.

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/c/c087be49ed1a5f41ce11fc2b24a7127514f913a7.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/6/6ca866ca70710efea15e45648a137d311735b07f.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/c/c6d94db5f8d56bd66cea7a8ef0a912cf5e448323.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/5/50ec508157f3efa859388caea6b438903830c7ad.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/6/6c30c0578d31ca4e213d15decf582dfd468ea8fb.png)

 ![image](https://global.discourse-cdn.com/sailpoint/original/2X/3/3d5446831295d636edfbed1fba7f72f0e4595cdf.png)

First HTTP Request JSON Body:

```auto
{
  "indices": [
    "identities"
  ],
  "query": {
    "query": "id:{{$.trigger.identity.id}}"
  }
}

```

Loop input:

```auto
$.hTTPRequest.body[0].access[?(@.type == "ENTITLEMENT" && @.source.name == "Active Directory")]

```

Loop context:

```auto
$.trigger.identity

```

Second HTTP Request JSON Body:

```auto
{
  "requestType": "REVOKE_ACCESS",
  "requestedFor": [
    "{{$.loop.context.id}}"
  ],
  "requestedItems": [
    {
      "comment": "Please remove",
      "id": "{{$.loop.loopInput.id}}",
      "name": "{{$.loop.loopInput.name}}",
      "type": "{{$.loop.loopInput.type}}"
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![mikeburns365](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mikeburns365/32/6890_2.png) [@mikeburns365](https://developer.sailpoint.com/discuss/u/mikeburns365)\
**Post date:** [October 11, 2023, 8:22pm UTC](https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692/5 "2023-10-11T20:22:37Z")

</div>

@jsosa would you mind sharing the JSON output of this workflow?

I am attempting to do the same thing but having trouble with my “HTTP Request 1” properly accepting the Loop Input variable

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [October 26, 2023, 2:28pm UTC](https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692/6 "2023-10-26T14:28:22Z")

</div>

A post was split to a new topic: [Unable to reference identity ID in loop context](https://developer.sailpoint.com/discuss/t/unable-to-reference-identity-id-in-loop-context/19807)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [December 25, 2023, 2:28pm UTC](https://developer.sailpoint.com/discuss/t/remove-all-entitlements-with-workflow/16692/7 "2023-12-25T14:28:42Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.