Hello,
Does any one have workflow template, when entitlement from specific source marked as requestable true add that entitlement to segment.
Thanks
Can you please share your requirements.
Hi @msingh900
When we mark entitlements requestable true from Active Directory source I want to add those entitlements to Segment ID.
Hello Ravi. The workflow trigger catalog does not include an Entitlement Updated trigger, so there is no way to automatically fire a workflow the moment requestable changes on an entitlement.
If you are setting it through API – you could handle both in one step. The PATCH /v2026/entitlements/{id} endpoint lets you update requestable and segments together since both are patchable:
[
{ "op": "replace", "path": "/requestable", "value": true },
{ "op": "add", "path": "/segments/-", "value": "<segmentId>" }
]
If you are changing it through the UI – a Scheduled Trigger workflow would be the way to go. It would periodically pull your AD entitlements filtered by source.id and requestable eq true, loop through the results, and patch the segment onto any entitlement whose segments array does not already contain your segment ID. The filters parameter supports source.id and requestable but not segments, so that check needs to happen inside the loop.
@donavalli Which API you are using ? can you share the more detail of your request parameters
Hello Ravi. The loop looks like it is working. The failureItems in the output show that the HTTP Request inside the loop is returning 404 Not Found, which usually means the entitlement ID is not landing in the URL the way it should.
This could come down to how your Loop Input is set up. The variable path changes depending on what the loop is iterating over. If your Loop Input is something like $.getEntitlements.body, each item in the loop is a full entitlement object, so you would want to pull the ID from it like this:
https://<tenant>.api.identitynow.com/v2026/entitlements/{{$.loop.loopInput.id}}
But if your Loop Input already extracts just the IDs (for example $.getEntitlements.body[*].id), then each loop item is the ID itself, so the URL would just be:
https://<tenant>.api.identitynow.com/v2026/entitlements/{{$.loop.loopInput}}
For the PATCH itself, set the method to PATCH, pick JSON Patch as the Request Content Type, and use this body:
[
{
"op": "add",
"path": "/segments/-",
"value": "<segmentId>"
}
]
One thing that might help narrow it down quickly: try running the same PATCH call with one hardcoded entitlement ID. If that goes through, you will know the issue is in the loop variable path. Also check that the tenant URL is right and that {id} is not sitting in the URL as literal text.
Hi Harish,
In the loop http I have v3 in the url, after updated to v2026 now entitlements are adding, but its adding only 250 entitlements how can we add more entitlements.
Hello Ravi. The 250-entitlement limit is coming from the List Entitlements API. SailPoint list endpoints return a maximum of 250 records per request, so you need to paginate the GET request using limit and offset.
/v2026/entitlements?limit=250&offset=0&sorters=id&filters=<your-filter>
/v2026/entitlements?limit=250&offset=250&sorters=id&filters=<your-filter>
/v2026/entitlements?limit=250&offset=500&sorters=id&filters=<your-filter>
Keep the same filter and sorters=id on every request so the paging order remains consistent. Since the standard workflow Loop also supports a maximum of 250 items, process each API response through a separate Loop:
HTTP Request, offset 0
→ Loop page 1
→ HTTP Request, offset 250
→ Loop page 2
→ HTTP Request, offset 500
→ Loop page 3
You can add enough pages based on the expected entitlement count. If the number can grow significantly or must be handled dynamically, an external script using the SailPoint SDK or API would be more scalable than hardcoding offsets in the workflow.
Hi Harish,
Thank you, do you have template for using API
Thank you, I am able to create workflow using paginate.
Hi @donavalli
I did something similar for roles. Here is the approach i used for this which ensured that you do not end up looping through all the roles or entitlements everytime.
1. Same like this case, i had to use the schedule trigger which runs every hour.
- While fetching the entitltments to be updated, you can make use of filters based on the created and modified date. So you should search it like this → modified gt ( 5 hours before now ) and requesteable eq true. This will reduce the number of entitlements needs processing every time and you will be adding only the relevant entitlements to the desired segment.
- After this you can still have the recursion to be safe and if entitlements are more than 250.
- Then for each of the entitlement, you can check if they are already added into desired segment or not.
- If it is not added, then you can add it otherwise you can mark the workflow as complete.
This has been working fine for me for almost like a year already. Only thing you should mindful is not to iterate through each entitlements everytime, because that means you are consuming workflow APIs exponentially. And should plan to reduce them as much as possible.
I hope that helps.
Regards
Vikas.