Workflow for API/HTTP Request Search Query Subscription Results emailed

Hello,

I’m wondering if it’s possible to write a workflow that sends an HTTP request into your environment to run a search query and submit the saved subscription results to a specified email address.

So I was trying to create a search query that would generate a list of terminated users within a specified time range and email the results to a specified user.

I initially ran a search query, saved the results/query, subscribed to it and emailed users in that method. However, we do not want the email template for daily termination lists to have all the additional links to ISC or to download the query etc. You can alter the template, however that subscription email template is used for ALL subscriptions so altering that one email template is not possible.

I tried writing a script but I can’t seem to get my HTTP request to work.

{
“name”: “Daily Termination Report”,
“description”: “Runs a daily search for users who transitioned from active to inactive and sends an email summary.”,
“trigger”: {
“type”: “SCHEDULED”,
“attributes”: {
“frequency”: “daily”,
“dailyTimes”: [
“1970-01-01T13:00:00Z”
],
“timeZone”: “America/New_York”
}
},
“definition”: {
“start”: “Fetch Terminated Users”,
“steps”: {
“Fetch Terminated Users”: {
“type”: “action”,
“actionId”: “sp:http”,
“versionNumber”: 2,
“attributes”: {
“url”: “https://mysandboxenviornment.api.identitynow.com/v3/search”,
“method”: “POST”,
“authenticationType”: null,
“requestHeaders”: {
“Authorization”: “Bearer (my secret token)”,
“Content-Type”: “application/json”
},
“jsonRequestBody”: {
“indices”: [“event”],
“query”: “name:“Change Identity State Passed” AND attributes.oldState:“active” AND attributes.newState:“inactive” AND created:[now-10d TO now]”,
“sort”: [“created:desc”],
“size”: 100
},
“requestContentType”: “json”
},
“nextStep”: “Send Email”
},
“Send Email”: {
“type”: “action”,
“actionId”: “sp:send-email”,
“versionNumber”: 2,
“attributes”: {
“from”: “randomstaticemail@blank.com”,
“recipientEmailList”: [“myemail@blank.com”],
“subject”: “Daily Termination Report - Inactivated Users (Last 10 Days)”,
“body”: “The following users were marked as inactive in the last 10 days:NameEmailState ChangeTimestamp{% for hit in steps[“HTTP Request”].response.hits.hits %}{{ hit._source.target.displayName or hit._source.target.name }}{{ hit._source.target.email or hit._source.target.name }}{{ hit._source.attributes.oldState }} → {{ hit._source.attributes.newState }}{{ hit._source.created }}{% endfor %}”
},
“nextStep”: “success”
},
“success”: {
“actionId”: “sp:operator-success”,
“description”: “Workflow completed successfully.”,
“type”: “success”
}
}
}
}

Everytime i run the workflow, i get the HTTP request failed Error and a Step List of everything just being null. Any help would be greatly appreciated.

Couple of changes I have observed.

You need to escape “ in your query

name:\"Change Identity State Passed\" AND attributes.oldState:\"active\" AND attributes.newState:\"inactive\" AND created:[now-10d TO now]

Your post operation value is in caps. Did you hard code it in JSON file and uploaded it.

Your authenticationType is null. It should be either one of those that shows in UI.

Fix this once and check if it works