When inactive, remove entitlements or access profile

[sec_tech (Yoo Jaeheon)]

Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.

When an identity is marked as inactive or terminated,
I would like to request the removal of entitlements access profiles granted upon authorization.

I’m currently in the workflow, so if there are any additional tasks required, please let me know so I can assist.

Do I have to add HTTP Request to workflow?

If I have to add, how do I fill that information?

[jsosa (Julian Sosa)]

Hi @sec_tech ! I have this problem a couple of months ago, I could not get the Get Access/Manage Access work to achieve your objective, even putting the Manage Access inside a Loop.

I could do it with 2 HTTP Request actions, first one calls the IDN API to retrieve user’s entitlements, then put response in a Loop, and inside a the loop another HTTP Request which it calls IDN API to revoke entitlement.

I posted detailed solution here:

Remove all entitlements with workflow

Hi Colin, sorry I forgot to return here. I was not able to get objective using the Get Access / Manage Access actions. Instead I replaced the Get Access with a HTTP action, calling the search api to find user entitlements, and then replaced Manage Access action with another HTTP action, this time removing each entitlement as a request. [image] [image] [image] [image] [image] [image] First HTTP Request JSON Body: { "indices": [ "identities" ], "query": { "query": "id:{…