# Self-Service Certification Escalation: A Custom Workflows & Interactive Forms Solution **URL:** \ **Category:** Community Blog\ **Tags:** workflows, certifications, identity-security-cloud, apis\ **Created:** [July 7, 2026, 11:24pm UTC](https://developer.sailpoint.com/discuss/t/self-service-certification-escalation-a-custom-workflows-interactive-forms-solution/215955 "2026-07-07T23:24:41Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![trettkowski](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/trettkowski/32/36103_2.png) [@trettkowski](https://developer.sailpoint.com/discuss/u/trettkowski)\ **Post date:** [July 7, 2026, 11:24pm UTC](https://developer.sailpoint.com/discuss/t/self-service-certification-escalation-a-custom-workflows-interactive-forms-solution/215955/1 "2026-07-07T23:24:41Z")
![blog title card](https://global.discourse-cdn.com/sailpoint/original/3X/5/3/530298d1093c7f758bd50e925c98ee3216edfcf1.jpeg) ## **The Problem: The End-of-Quarter Certification Crunch** - **The Late-Reviewer Dilemma:** At the end of a quarterly or semi-annual access certification cycle, compliance administrators often face a common problem: a handful of non-responsive certifiers who have let their reviews sit past the deadline. - **The Manual Overhead:** Standard SailPoint Identity Security Cloud (ISC) campaigns allow notifications and automated reminders, but escalating past-due items to a reviewer’s manager typically requires manual intervention. An admin has to track down the certifications, identify the managers, and manually reassign each certification inside the UI. - **The Goal:** A Launchpad-driven self-service portal where administrators can view all active campaigns, selectively choose which ones to escalate, review a high-density summary of their choices, and programmatically reassign outstanding certifications to the respective reviewers’ managers. > **Note:** This workflow is intended specifically for incomplete, overdue certification campaigns. Additionally, this approach should be reviewed after the release of ISC Certifications 2.0, scheduled for July 15, 2026. * * * ## **The Architecture: A Two-Phase Escalation Combo** To build an efficient, rate-limit-conscious solution that does not cause workflow execution timeouts, the architecture is split into two distinct workflows and two interactive forms: ```mermaid graph TD A[Launchpad] --> B[Workflow 1: Selection & Summary] B --> C[Form 1: Campaign Selector] C --> D[Workflow 1: Serial Loop Concatenation] D --> E[Form 2: Confirm Selection] E --> F{Approved?} F -- Yes --> G[Loop and Trigger Workflow 2 via HTTP] F -- No --> H[End Step - Success] G --> I[Workflow 2: Certification Escalator] I --> J[GET Active Incomplete Certifications] J --> K[Serial Loop: Reassign to Reviewer's Manager] ``` - **Workflow 1: Certification Selection For Escalation** - **Workflow 2: Certification Escalator** - **Design Decision: Why Split Into Two Workflows?** * * * ## **User Interface: Interactive Forms** By leveraging ISC Interactive Forms, we can build a clean, guided experience. ### **1. Campaign Selector Form** The first form asks the user if they want to target all active campaigns or specify a list. A form condition shows the campaign selection dropdown only when the toggle is turned off. - **Input Fields:** - **Escalate All Active Campaigns? (Toggle):** Defaults to `true` (Escalate All Campaigns) or `false` (Escalate Campaigns Below). - **Campaign Selector (Dropdown):** Multi-select dropdown populated dynamically by Workflow 1 with the names and IDs of active campaigns. [Form-Certification Campaign Selector.json](https://developer.sailpoint.com/discuss/uploads/short-url/re1kUW6RaPRmCw7qXXzWwnRs1pk.json) (3.0 KB) ![image](https://global.discourse-cdn.com/sailpoint/original/3X/4/d/4d573044f04294d8ee405f8fb61b21fcf646a720.png) ### **2. Confirmation Form** The second form uses a description block to render a dynamic HTML preview generated during the workflow’s execution. This ensures the admin knows exactly which campaigns they are about to escalate before executing. - **Input Fields:** - **Dynamic Campaign Selections (Description Block):** Displays the formatted HTML summary. - **Approve or Deny (Toggle):** Requires the administrator to actively flip to “Approved” and click submit. [Form-Confirm Campaign Selection.json](https://developer.sailpoint.com/discuss/uploads/short-url/5jDzKZ6arRHdfUXjogUbhKmnnYD.json) (2.1 KB) ![image](https://global.discourse-cdn.com/sailpoint/original/3X/d/9/d96f8fcd1257549453ae1f240a64df3fa2fdd71d.png) * * * ## **Backend: Workflow Details** ### **Workflow 1: Certification Selection For Escalation** This workflow is responsible for querying campaigns, orchestrating the interactive forms, and dynamically compiling the campaign selection summaries. - **Trigger:** `idn:interactive-process-launched` (Interactive Form Launcher) - **High-Density Summary Generation:** The workflow dynamically constructs the summary depending on whether the administrator selected the “Escalate All Campaigns” toggle in Form 1. By branching the summary variable compilation, the workflow can display either a large card-style preview for single/individual selections, or a high-density, consolidated inline list for bulk campaigns to prevent Form 2 from overflowing: ![image](https://global.discourse-cdn.com/sailpoint/original/3X/2/5/255a2253562cebd388d3d4dd511cb692f18d0935.png) - **All Campaigns Selected (Consolidated View):** When “Escalate All Campaigns” is toggled, looping through every active campaign could result in massive page heights. The workflow builds a high-density list using inline vertical piping and dashed separators: ```html
🔹 {{$.loop.loopInput.name}}  |  ID: {{$.loop.loopInput.id}}  |  📅 {{$.loop.loopInput.deadline}}
``` ![image](https://global.discourse-cdn.com/sailpoint/original/3X/5/d/5db615cf4b25d34406a5c8c85c6b2aece2c04dfb.png) - **Decoupled Asynchronous Execution:** After approval, rather than reassigning certifications directly within the main workflow (which would risk hitting workflow limits), it loops through the selected campaigns and makes a POST request to Workflow 2’s external endpoint, passing `campaignid` as a payload. This decouples the selection UI from the heavy-duty reassignment logic. [Workflow-Certification Selection For Escalation.json](https://developer.sailpoint.com/discuss/uploads/short-url/p08oi9W4f7PaBX0CvXpgIjgtLZ9.json) (26.9 KB) ### **Workflow 2: Certification Escalator** This workflow performs the actual heavy lifting. It executes asynchronously in the background for each escalated campaign. - **Trigger:** `idn:external-http` (External HTTP Request) - **Reassignment Logic:** It gathers all incomplete active certifications, loops through them, gets each reviewer’s manager, and submits a POST to the campaign reassignment API. [Workflow-Certification Escalator.json](https://developer.sailpoint.com/discuss/uploads/short-url/lu09GHmNjvZENz3d5sOB3WM1B6c.json) (6.5 KB) * * * ## **API Operations** The combo workflow makes three critical API calls: 1. **Get All Active Campaigns:** 2. **Get Certifications per Campaign:** 3. **Reassign Certification:** * * * ## **Platform Limitations & Best Practices** When deploying this solution, keep the following platform behaviors and bounds in mind: - **The 250 Pagination Limits and Early Cancellation Checks:** To maintain platform stability and protect workflows from unexpected behavior, the solution enforces hard limits at two stages, backed by early-exit cancellation checks: - **Campaign Limit (Form 1 and All-Campaign Toggle):** The initial API call retrieves a maximum of 250 active campaigns (which is the default API pagination page limit). If the user toggles “Escalate All Active Campaigns”, the workflow is designed to safely handle up to 250. If the active campaign response count is exactly 250, we immediately cancel/exit the workflow early (using a decision branch) to prevent unintended or incomplete behavior. - **Certification Limit (Escalator Workflow):** The second workflow retrieves up to 250 active certifications per campaign. If there are exactly 250 certifications returned, this indicates that the campaign size exceeds our single-page query limit. To avoid partial escalations and out-of-order reassignments, we have a check (`Compare Multi Type 2` step comparing the body length to `250`) that terminates the escalator workflow early if the threshold is met. - **Why these limits are practical:** In a production setting, having more than 250 concurrent active campaigns is highly improbable. Similarly, because escalations are typically run near the end of a review cycle, only a small fraction of certifications (typically well under 250) remain past due and need escalation in a single campaign. - **Launchpad Role Restrictions:** Ensure that access to the “Certification Selection For Escalation” interactive trigger is restricted. Only authorized compliance managers or IAM administrators should be allowed to run the tool. - **Manager Integrity:** The escalator workflow checks if a manager ID exists for the reviewer (using a `Compare Multi Type` step). If a reviewer does not have an assigned manager, the workflow skips that certification, ensuring it doesn’t fail or throw API errors. * * * ## **Conclusion** - **Summary:** Splitting this escalation solution into a selection UI workflow and an asynchronous worker workflow ensures speed, compliance reviews, and high reliability. Interactive forms bring IIQ-like workflow flexibility to the modern Identity Security Cloud platform. - **Call to Action:** Have you implemented similar delegation or escalation flows in your environment? How does your organization handle overdue reviews? Let’s discuss in the comments below! ---
**Author:** ![rauls](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/rauls/32/11651_2.png) [@rauls](https://developer.sailpoint.com/discuss/u/rauls)\ **Post date:** [July 15, 2026, 6:46am UTC](https://developer.sailpoint.com/discuss/t/self-service-certification-escalation-a-custom-workflows-interactive-forms-solution/215955/2 "2026-07-15T06:46:57Z")
Hey @trettkowski , Great work. So many of us have been forced to build around SailPoint’s limitations. That being said, some of us were using PowerAutomate, N8N and other tools to fill in the gaps for the missing parts of the Access Review capabilities. I am hoping, the new gen certs will cover most of these gaps, I feel it’s quite frustrating that such a great tool, has these kinds of limitations of what should be standard features. ---
**Author:** ![trettkowski](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/trettkowski/32/36103_2.png) [@trettkowski](https://developer.sailpoint.com/discuss/u/trettkowski)\ **Post date:** [July 15, 2026, 10:53am UTC](https://developer.sailpoint.com/discuss/t/self-service-certification-escalation-a-custom-workflows-interactive-forms-solution/215955/3 "2026-07-15T10:53:18Z")
Thank you Raul! Completely agree. I only built this because one of my clients was waiting on an [ideas portal entry from 2021 to be added](https://ideas.sailpoint.com/ideas/GOV-I-853), but they finally gave up hope and had me build this workaround. Unfortunately, I don’t think Next Gen Certs has this capability yet, but I’m sure they are looking at implementing something OOTB soon.