Hi all, I’m working with a Web Services SaaS connector in SailPoint IdentityNow / ISC, using GraphQL as the underlying API. The target application does not support ADD or REMOVE operations for entitlements. Instead, it only exposes a single mutation: mutation UpdateUser This mutation expects t…

@ashwink Did you try using the SaaS Connectivity Customizers - Connectivity Customizers | SailPoint Developer Community

did you try cloud before prov’ rule? on modify operation for add/remove entitlement, your rule should get use idnutil to get all entitlements of the user for the account and update plan. I have not tried it myself but I am interested in knowing how this goes.

IMO it is a failing on Sailpoint, that there is not a Source attribute or checkbox in the UI to allow for all entitlements to be sent in a request, not just the delta. Seems a no-brainer that should have been part of Web Service Connector design

This is not possible in the web service saas connector.

Can you elaborate what’s not possible?

I think you did not get me right. I am referring to : [image] Web Services Before Operation Rule | SailPoint Developer Community This rule calculates attributes before a web-service operation call. Web Services Before Operation Rule [image] Before …

I’am using the SaaS version will this work?

yes. the before operation rule will work no matter if its VA or SaaS connector.

I attempted to use a WebServiceBeforeOperationRule on a Web Services SaaS connector to merge entitlement values before an updateUser call. Although the rule can be created and linked, it is never executed and has no effect on the request. Based on testing and documentation, Before/After Operation Ru…

Web Services SaaS connector – How to handle ADD/REMOVE entitlements when API only supports UpdateUser (GraphQL)

Identity Security Cloud (ISC) ISC Discussion and Questions

ashwink (Ashwin Kedar) January 12, 2026, 11:55am 7

See: Before/After rule supported for WS SaaS Connector? - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community & Configure Endpoint Customization Before Operations

Topic		Replies	Views
Web Service Connector Understand Add Entitlement Operation Flow ISC Discussion and Questions identity-security-cloud , identityiq	7	332	September 8, 2025
Remove Entitlement Web Service ISC Discussion and Questions webservice-connector , identity-security-cloud	11	248	July 18, 2025
Web service connector Add Entitelement operation ISC Discussion and Questions	4	2120	July 19, 2023
Web Services SaaS Connector ISC Discussion and Questions webservice-connector , identity-security-cloud , provisioning , access-requests	9	1523	November 28, 2023
Webservice UpdateAccount operation overriding existing entitlements ISC Discussion and Questions webservice-connector , identity-security-cloud , provisioning	7	655	June 2, 2024

Web Services SaaS connector – How to handle ADD/REMOVE entitlements when API only supports UpdateUser (GraphQL)

Related topics