I’m working as an ISC SailPoint Developer and recently worked on generating an Orphan/Uncorrelated Accounts Report.
My requirement is to retrieve all uncorrelated (orphan) accounts and send a scheduled email report to the operations team. Initially, I planned to achieve this using the ISC Search API. However, after going through the documentation, I found that the Search API does not seem to support fetching uncorrelated/orphan accounts.
My questions are:
Is there currently any API or supported approach to retrieve all uncorrelated/orphan accounts programmatically?
Are there any recommended alternatives for automating this report and emailing it on a schedule?
Is support for searching uncorrelated accounts planned for a future release of the Search API?
I’d appreciate any guidance or best practices from anyone who has implemented a similar solution.
You are right, the Search API does not expose uncorrelated as a searchable field, so that won’t work here. For your use case, the List Accounts API (GET /v3/accounts) is what you need. It supports uncorrelated as a filterable field with the eq operator. The call looks like this:
GET /v3/accounts?filters=uncorrelated eq true&limit=250&offset=0&count=true
To scope it to a specific source:
GET /v3/accounts?filters=uncorrelated eq true and sourceId eq "<sourceId>"&limit=250&offset=0&count=true
Max page size is 250, so you will need to paginate with offset if there are more records. The count=true gives you the X-Total-Count header so you know how many total records to expect.
For the scheduling part, I think ISC doesn’t have a built-in way to email uncorrelated account reports on a schedule. You can try using an external scheduled job (cron, Azure Function, AWS Lambda, whatever fits your stack) that calls the API, builds a CSV, and emails it out.