Problem
Attribute synchronization is a critical function in SailPoint Identity Security Cloud (ISC) that update’s identity attributes from SailPoint into downstream applications or HRMS target systems where write-back capabilities are in scope. Typically, attribute synchronization triggers automatically during account aggregation (followed by an identity refresh) or runs on a global schedule twice a day.
However, when administrators need to force an immediate attribute sync for a specific subset of users, relying on the User Interface (UI) becomes highly inefficient. Navigating to individual identities, clicking the actions button, and selecting “Synchronize Attributes” works for isolated cases, but executing this manually for 20 or more users is tedious and time-consuming.
Diagnosis
To bypass the limitations of manual UI management, administrators can leverage the SailPoint ISC REST API via an automated PowerShell script or Postman client. By programmatically executing recursive API calls, you can rapidly synchronize attribute values across downstream applications for a predefined list of identities without manual intervention.
Solution
This procedure outlines how to configure and execute a PowerShell script designed to process a bulk identity attribute synchronization using an input CSV file.
Prerequisites
Before running the script, ensure your local environment meets the following technical requirements:
- A Windows machine running PowerShell 5.1 or higher, or PowerShell Core on any supported operating system.
- Network access to the SailPoint ISC base API URL: https://.api.identitynow.com.
- A valid SailPoint API Bearer Token endowed with sufficient administrative privileges to invoke identity synchronizations.
- The script file saved locally on your machine (e.g., BulkIdentitySync.ps1). Refer the below script details
# ==============================
# SailPoint ISC - Attribute Synchronization for Multiple Identities (CSV)
# ==============================
# --- Configuration Variables ---
$baseUrl = "https://<TENANT_NAME>.api.identitynow.com" # Replace with your ISC base URL
$apiToken = "<SAILPOINT_ISC_BEARER_TOKEN>" # Replace with your valid Bearer token
$csvPath = "C:\path\to\identities.csv" # Update with the path to your CSV file
# --- Define Headers ---
$headers = @{
"Authorization" = "Bearer $apiToken"
"Cache-Control" = "no-cache"
"Content-Type" = "application/json"
"X-SailPoint-Experimental" = "true"
}
# --- Define the Body ---
$body = "{}"
# --- Verify CSV Existence ---
if (-not (Test-Path $csvPath)) {
Write-Error "The specified CSV file was not found at: $csvPath"
exit
}
# --- Import Identities from CSV ---
$identities = Import-Csv -Path $csvPath
# --- Loop Through Each Identity Row ---
foreach ($row in $identities) {
# Extract the ID (Assumes your CSV has a column header named 'IdentityId')
$identityId = $row.IdentityId
# Skip empty rows if any
if ([string]::IsNullOrWhiteSpace($identityId)) {
Write-Host "Skipping entry with empty Identity ID." -ForegroundColor Yellow
continue
}
# --- Construct the Dynamic API Endpoint ---
$endpoint = "$baseUrl/v2024/identities/$identityId/synchronize-attributes"
# --- Execute API Call ---
try {
Write-Host "Invoking SailPoint ISC API for ID ($identityId): $endpoint" -ForegroundColor Cyan
$response = Invoke-RestMethod -Uri $endpoint -Method Post -Headers $headers -Body $body
Write-Host "Synchronization request sent successfully for ID: $identityId" -ForegroundColor Green
if ($response) {
Write-Host "Response:" -ForegroundColor Yellow
$response | ConvertTo-Json -Depth 5
}
}
catch {
Write-Host "Error occurred while calling the API for ID ($identityId):" -ForegroundColor Red
Write-Host $_.Exception.Message
if ($_.ErrorDetails) {
Write-Host "Details:" $_.ErrorDetails.Message
}
}
Write-Host "--------------------------------------------------"
}
Step-by-Step Execution Procedure
Step 1: Prepare the CSV Input File
- Open a text editor (e.g., Notepad, VS Code) or Microsoft Excel.
- Create a column with the exact header name: IdentityId. Note: Target Identity IDs can be extracted from your environment using SailPoint ISC Search Queries.
- List your target SailPoint Identity IDs line by line beneath this header.
- Save the file in a CSV (Comma Delimited) format.
Example CSV Layout:
IdentityId
feee59bf7254462f9e4bbcbe0faf11fd
ae10caaac42b4122b299766666d5b09e
Step 2: Configure the Script Variables
- Right-click your local BulkIdentitySync.ps1 script file and open it in a text editor or integrated development environment (such as VS Code or PowerShell ISE).
- Locate the Configuration Variables section at the top of the file.
- Modify the following parameters to match your environment:
- $baseUrl: Ensure this points to your specific SailPoint tenant API URL.
- $apiToken: Replace the placeholder string with your active, unexpired administrative Bearer token.
- $csvPath: Update this to the exact, full directory path where your input CSV file is saved.
- Save and close the file.
Step 3: Run the Script
- Launch a PowerShell console window.
- Change directories to the folder containing your script by executing the cd command:
cd "C:\Path\To\Your\Script\Folder"
- Execute the script by entering:
.\BulkIdentitySync.ps1
- Press Enter to initiate the bulk processing sequence.
Monitoring and Expected Output
The script processes the identities listed in the CSV sequentially. It outputs real-time, color-coded console logs so you can monitor the status of the operation:
- Cyan Text: Signals the initiation of an API call and displays the specific target URL of the Identity ID currently being processed.
- Green Text: Confirms that the synchronization request was successfully validated and accepted by SailPoint ISC.
- Yellow Text: Formats and outputs the raw JSON API response returned directly from the system for deep verification.
- Red Text: Indicates an execution failure for that specific identity, displaying the error message alongside any technical details provided by the API.
Note: The script safely handles data anomalies by automatically skipping completely empty or whitespace-only rows within the CSV file, generating a console warning before seamlessly advancing to the next available entry.