Hi,
The roles API docs here list-roles-v-1 | SailPoint Developer Community is missing the ‘values’ object. I think this is already a reported issue in the sailpoint-oss api docs repo as well but figured I’d point it out here as well in context.
The behaviour I wanted to mention is that when you update a single leaf node, through the UI, to a list input (i.e ‘values’ rather than ‘stringValue’), then every other supported leaf node (where operation = EQUALS) will also be updated to use ‘values’ and ‘stringValues’ will be set to null. This might be done for simplicity, but the API does not have such behaviour enforced.
This isn’t necessarily a problem as the role will continue to function regardless of the method of updating it - I discovered this through state drift while testing a terraform provider but in a production environment you shouldn’t be editing any state-backed resource through the UI anyway. I’m not sure if there’s any other scenario where this behaviour would surface.
The second thing I wanted to ask about is data validation. Currently the Roles API seems to trust the client as long as the data types are valid. What this means is that while in the UI I’m constrained to picking through a list of identity/account attributes, the API will let any values pass, bar invalid data types. I’m guessing performance is the main concern here, but I wanted to bring this up as a topic of discussion. We’re migrating the management of certain resources over to terraform and not having data validation in place means a user(and change reviewer) would need to verify each input against values returned by a different endpoint (since the UI values aren’t 1to1 with the technical objects), otherwise broken resources can be built that would on first glance appear valid.