SailPoint Identity Security Cloud (ISC) provides SaaS Workflows that organizations use extensively to automate identity lifecycle processes and business requirements. In many implementations, developers use the HTTP Action within workflows to invoke SailPoint APIs directly.
Recently, SailPoint announced the deprecation of several older API collections and recommends migrating to the latest ISC API collection.
The following API collections are now considered deprecated:
- V2026 API
- V2025 API
- V2024 API
- V3 API
- Beta API
Although these APIs may continue to work for some time, SailPoint is no longer actively maintaining them and recommends moving to the latest ISC APIs to ensure future compatibility and support.
Over time, organizations can accumulate hundreds of workflows. Many of these workflows may contain HTTP actions that call deprecated SailPoint APIs.
Manually reviewing each workflow to identify deprecated API usage is:
- Time-consuming
- Error-prone
- Difficult to manage at scale
As a result, customers need an automated way to:
- Discover workflows using deprecated APIs.
- Identify the affected HTTP actions.
- Understand which new ISC APIs should be used instead.
- Create a roadmap for API migration before deprecated endpoints are retired.
Solution – Workflow Analyzer Utility
The Workflow Analyzer Utility is an executable tool designed to analyze all SailPoint workflows within a tenant and identify deprecated API usage.
What the Utility Does
The utility:
- Connects securely to the SailPoint tenant.
- Reads all available workflows.
- Inspects workflow HTTP actions.
- Identifies API calls made to deprecated API collections.
- Generates a detailed report.
- Provides recommendations for equivalent ISC APIs where applicable.
Key Benefits
Automated Assessment
Eliminates the need to manually inspect every workflow.
Faster API Migration
Quickly identifies workflows requiring remediation and suggests alternative ISC APIs.
Improved Compliance
Helps ensure workflows align with SailPoint’s latest API standards and best practices.
Reduced Risk
Allows teams to proactively address API deprecations before they impact production workflows.
Security and Permissions
The utility uses Client Credentials Authentication and requires only minimal permissions.
Required Scope
sp:workflow:read
This scope grants read-only access to workflow definitions, ensuring the tool follows the principle of least privilege.
The utility:
- Does not modify workflows.
- Does not create workflows.
- Does not delete workflows.
- Only reads workflow metadata and definitions for analysis.
Execution Steps
Launch the utility by double-clicking:
Open “Analyze-SailPointWorkflows.ps1” on Windows PowerShell ISE
Step 2
Provide the requested information:
- SailPoint Tenant URL
- Client ID (PAT : sp:workflow:read)
- Client Secret
Step 3
The utility authenticates using the provided client credentials.
Step 4
The utility scans all workflows and analyzes API usage.
Step 5
A report is generated showing:
- Workflow Name
- HTTP Action Name
- Deprecated API Endpoint Used
- Deprecated API Collection
- Recommended ISC API
- Migration Comments
If you’re updating the blog/community post, I’d add a dedicated “How the Script Works” section like the following:
How the Script Works
The script performs a full workflow inventory and analysis to identify references to deprecated SailPoint Identity Security Cloud (ISC) APIs and recommend modern replacements.
1. Authenticate to Identity Security Cloud
The script first prompts for:
- Tenant name
- Domain name (
identitynow,identitynow-demo, etc.) - OAuth client ID
- OAuth client secret
Using these values, it requests an access token from the tenant’s /oauth/token endpoint using the OAuth 2.0 Client Credentials grant flow. The token is then used for all subsequent API calls.
2. Retrieve All Workflows
After authentication, the script retrieves workflow definitions using the ISC Workflows API:
Because tenants may contain hundreds of workflows, the script implements pagination using limit and offset parameters. It continuously requests workflow pages until a response returns fewer records than the specified page size.
This ensures that:
- All workflows are analyzed
- No manual export is required
- Large environments are handled automatically
3. Deep Inspection of Workflow Definitions
Each workflow is recursively traversed using the Search-ObjectForDeprecatedApis function.
Rather than only examining workflow metadata, the script inspects the complete workflow JSON structure, including:
- Trigger configurations
- Actions
- Action inputs
- HTTP request definitions
- Nested objects
- Arrays and collections
- Custom payloads
- URLs embedded in string values
This recursive approach allows the script to identify API references regardless of where they appear within the workflow definition.
4. Identify HTTP Actions and Deprecated API Usage
During traversal, every string value is evaluated against a regular expression pattern:
/(beta|v3|v2024|v2025|v2026)/
The script flags URLs containing deprecated or non-production API versions such as:
https://tenant.api.identitynow.com/beta/accounts
https://tenant.api.identitynow.com/v3/search
https://tenant.api.identitynow.com/v2025/campaigns
For each match, the script captures:
- Workflow name
- Workflow ID
- Action name
- Step ID
- Workflow path location
- Deprecated URL detected
This context makes it easy to identify the exact workflow action requiring remediation.
5. Build a Reference Catalog of Current ISC APIs
To provide meaningful recommendations, the script dynamically loads the current SailPoint API catalog from:
The catalog loader:
- Collects all API category URLs.
- Extracts API documentation slugs.
- Builds an internal lookup index.
- Generates normalized lookup keys for matching.
Examples:
- access-profiles
- entitlements
- identities
- sources
- workflows
- campaigns
These entries become the reference library used when generating replacement recommendations.
6. Map Legacy API Paths to Current API Documentation
Once a deprecated URL is found, the script extracts resource path segments following the version identifier.
Example:
/v3/search
Produces:
search
Example:
/beta/accessProfiles
Produces:
accessProfiles
The script then:
- Converts camelCase values to kebab-case
- Generates multiple candidate lookup keys
- Searches the API documentation index
- Attempts to identify the most relevant modern ISC API
If a match is found, the report links directly to the corresponding SailPoint Developer documentation page.
For example:
/beta/accessProfiles
mapped to:
If no exact mapping can be determined, the script directs users to the main API documentation hub for manual validation.
7. Generate Recommended Actions
For every deprecated API reference discovered, the script generates remediation guidance.
Examples include:
The /beta/ API is not recommended for production.
Use the current Access Profiles API instead.
or
The /v3/ API is not recommended for production.
No exact documentation match was found.
Browse available APIs at:
This provides administrators with both the affected location and the recommended modernization path.
8. Generate an Interactive HTML Report
After analysis is complete, the script creates a professional HTML report that includes:
- Total workflows scanned
- Total findings
- Workflow name
- Workflow ID
- Action details
- Deprecated URL
- Suggested remediation
- Replacement documentation URL
The report also includes:
- Client-side filtering/search
- Column sorting
- Responsive layout
- Direct links to SailPoint documentation
- Summary statistics and scan metadata
This allows administrators and workflow developers to quickly prioritize remediation efforts and modernize workflows before deprecated endpoints are retired.
Outcome
The result is a tenant-wide assessment of workflow API usage that helps identify technical debt, surface unsupported API versions, and accelerate migration to current SailPoint Identity Security Cloud APIs without manually reviewing every workflow definition.
This level of detail explains exactly how workflows are retrieved, how HTTP/API references are discovered, how legacy endpoints are mapped to current ISC APIs, and how the final report is produced.
Analyze-SailPointWorkflows.ps1 (29.1 KB)