Webservices Connector Account Attribute Promoted As Entitlement - Deletion Issue

[imagavis (Sivagami Annamalai)]

I have a web services connector where I’ve configured an account aggregation operation. The API response provides the role assigned to the user (Users can have only one role)

Since I don’t have separate entitlement aggregation call available due to API limitations, I will mark role as an entitlement in the account schema. This is pulling Admin, User and Reviewer as entitlement as expected based on the response below.

Example response:

[
  {
    "id": 1,
    "name": "Admin User",
    "email": "[email protected]",
    "role": "Admin"
  },
  {
    "id": 2,
    "name": "User 1",
    "email": "[email protected]",
    "role": "User"
  },
  {
    "id": 3,
    "name": "Review User",
    "email": "[email protected]",
    "role": "Reviewer"
  }
]

When the response gets updated and we don’t have any user assigned as part of the role - Reviewer, I want the entitlement to be deleted in Sailpoint. But, the entitlement stays as is and only the account assignment is cleared from it. How do I ensure the entitlement gets deleted in Sailpoint when no users are assigned to it?

[vbdm (Veera bhamidipati)]

Hi @imagavis ,

Your requirement may be similar to the question posted here:

Delete Entitlements from source

@sivakrishna_1993 In our case, we are not doing entitlement aggregation explicitly to pull groups, instead the entitlements come from account aggregation. So i will be updating the Linux source with new IP address and will run unoptimized aggregation to only have new accounts. But my source will end up having old entitlements as well. Hence I’m looking for some options other than reset to clear entitlements that gets created through entitlement aggregation.

And it looks like he found a solution by referring to the topic here:

Delete Entitlements from source

@chandramohans27 have a look at this topic and the linked APIs that Colin updated in the first post. There was a lot of discussion around that original endpoint in the topic that you can review. It looks like there are now replacement APIs in the Beta collection that can be used, as on 4/11: POST /api/source/reset/ Here are the links that Colin referenced in the above post for faster access: To reset all entitlements on a source, use reset-source-entitlements | SailPoint Developer Community . …

Let us know if this helps

Regards

[imagavis (Sivagami Annamalai)]

Thanks @vbdm for the insights! Unfortunately, I don’t want to clear all entitlements in Source. I only want to delete the ones that aren’t assigned to the user.

When an attribute in account schema of type string is promoted as entitlement, system creates an entitlement but there is no way the entitlement gets deleted today. I’m looking for a solution to get it deleted when no user is assigned to the entitlement.