Unable to Search Access Profiles Using iscAccessType = privileged

SailPoint Human Fabric (SHF) SHF Discussion and Questions
,
1

Hi all,

I created an Access Profile and set the out-of-the-box Access Type metadata to Privileged.

However, when I try to search for the Access Profile using @accessModelMetaData with the following values:

key = iscAccessType
value = privileged

the Access Profile is not returned in the search results.

Is there a supported way to identify or filter all Access Profiles that have Access Type = Privileged? Also, is iscAccessType expected to be exposed through the Access Profile APIs/search index?

Thanks!

2

Hi @abhik_4
Welcome to the developer community.

Access profiles are not indexed for nested @accessModelMetadata queries. The searchable fields reference lists @accessModelMetadata(...) under entitlements and roles only (which, I agree, is frustrating). The Access Profiles section has no metadata field, and the AccessProfileDocument search model in the v2026 API spec does not include one either. @kselvaraj hit the same thing in this thread, where the @ query returned roles only.

In an earlier thread, @jlee555 found that dropping the @ and using dotted field names brought access profiles back into metadata results. For your case that would be:

accessModelMetadata.key:iscAccessType AND accessModelMetadata.value:privileged

Run it with only Access Profiles selected, or with "indices": ["accessprofiles"] in Perform Search. This is not a nested query, so the key and value conditions can match two different metadata attributes on the same profile. Spot-check the results. The syntax is also undocumented for access profiles, so I would not base a scheduled process on it.

For a documented route, use the API. The access profile object does carry the metadata: List Access Profiles returns accessModelMetadata on each profile. Its filters parameter only supports id, name, created, modified, owner.id, requestable and source.id, so page through all profiles and filter on your side for entries shaped like this:

"accessModelMetadata": {
  "attributes": [
    {
      "key": "iscAccessType",
      "values": [ { "value": "privileged" } ]
    }
  ]
}

So on your second question: iscAccessType is exposed on the Access Profile API, but it is not part of the documented access profile search index.

4

Hi @Pratyush27 ,

Tried the suggested approach but no result both in the SailPoint ISC Search UI as well as Perform Search API. Attaching images below.

image
image1911×783 45.9 KB

image
image1376×666 40.2 KB

FYI, me and @arijitdas tried adding custom attributes it is returning as it supposes to.

Thank You!!

5

Nice work, @abhik_4 and @arijitdas. Custom metadata attributes returning access profiles while the out-of-the-box iscAccessType attribute does not is a useful finding.

Please could you post your steps as a reply here: the custom attribute key and values you created, how you assigned it to the access profile, and the exact query that returned it?
Then mark that reply as the solution. Anyone who searches for iscAccessType later will land on this thread, and a worked example will save them the same trial and error.

Thanks for testing in both the Search UI and the API and reporting back.

6

Hello Abhik. Since the dotted-field query also returns nothing for the built-in iscAccessType, I would not rely on Search for this attribute right now.

For a documented API path, try the dedicated metadata filter:

POST /access-profiles/v1/filter

{
  "ammKeyValues": [
    {
      "attribute": "iscAccessType",
      "values": ["privileged"]
    }
  ]
}

Before you run it, confirm the exact technical value for that attribute under Admin > Access Model > Metadata, and use that value in ammKeyValues rather than the display label Privileged. If the stored value is different, that alone would explain the empty results.

When you test: a 403 means the token/client is not authorized to use the endpoint, which is different from a 200 with an empty list.

Could you try the filter endpoint against the same Access Profile and share the result? If it returns a 200 with no match while the profile clearly has that iscAccessType value, I would raise it with SailPoint as a possible issue with this built-in metadata attribute.

Filter Access Profiles by metadata | Searchable Fields

7

Hi @abhik_4 ,

I tried and these work for me :

  • From UI
@accessModelMetadata(key:"iscAccessType" AND value:"system")
  • API
{
    "query": {
        "query": "@accessModelMetadata(key:\"iscAccessType\" AND value:\"system\")"
    },
    "indices": [
        "accessprofiles"
    ],
    "includeNested": false,
    "sort": [
        "name"
    ]
}

image
image1222×782 39.9 KB