Report for Deleted Access Items and Users Who Previously Had Them

[sxxnex (sojeong park)]

Hi everyone,

I would like to check if the following is possible in Identity Security Cloud.

I’m trying to generate a combined report/list that shows deleted Roles or deleted Entitlements together with the list of Identities who previously had access to those items.

Current situation:
It seems that I can verify this only on a per-user basis using Access History, but this doesn’t give me a consolidated view.

Goal:
I want to know if there is any way to produce a single report or unified list that displays:

• Deleted Roles / deleted Entitlements

• And the Identities who had those accesses before deletion

If anyone has done something similar or knows whether this is supported (via Search, Reports, Access History API, etc.), your guidance would be greatly appreciated.

Thank you!

[HussainshaSyed001 (Hussainssha Syed)]

use API /access-request-status and look response have REVOKE_ACCESS and from that you can pull accordingly

[sxxnex (sojeong park)]

This isn’t a case where a user’s access was revoked — the Role or Entitlement itself was deleted. What I’m referring to is the list of users who had those permissions before they were deleted.

[schattopadhy (SHANTANU CHATTOPADHYAY)]

@sxxnex

a user’s access was revoked — the Role or Entitlement itself was deleted. What I’m referring to is the list of users who had those permissions before they were deleted.

@sxxnex you can check events with delete role passed as shown below

[suresh4iam (Suresh Kumar Palanisamy)]

I don’t think you can get the combined report directly what you required. But I would use multiple ISC APIs to try to build the report via Workflow or any programming language.

1. Get the list of deleted role or entitlement events by using Search API search-post | SailPoint Developer Community
2. Get the role name from the Search response, I’m not sure whether it returns role/entitlement IDs to use it in the next step.
3. Use the identity history API list-identity-snapshot-access-items | SailPoint Developer Community to loop through all the identities by using access item name filter and get the list.
4. Or try to use another search API instead of steps 2 & 3 to get the “Remove Role Passed” events with role name attribute value.