Pending Access Request Approvals List

GET 
https://sailpoint.api.identitynow.com/beta/access-request-approvals/pending

This endpoint returns a list of pending approvals. See "owner-id" query parameter below for authorization info.

Request

Query Parameters

owner-id string
If present, the value returns only pending approvals for the specified identity.
• ORG_ADMIN users can call this with any identity ID value.
• ORG_ADMIN users can also fetch all the approvals in the org, when owner-id is not used.
• Non-ORG_ADMIN users can only specify me or pass their own identity ID value.
limit int32
Possible values: <= 250
Max number of results to return. See V3 API Standard Collection Parameters for more information.
Default value: 250
Example: 250
offset int32
Offset into the full result set. Usually specified with limit to paginate through the results. See V3 API Standard Collection Parameters for more information.
Default value: 0
Example: 0
count boolean
If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored.
Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used.
See V3 API Standard Collection Parameters for more information.
Default value: false
Example: true
filters string

Filter results using the standard syntax described in V3 API Standard Collection Parameters

Filtering is supported for the following fields and operators:

id: eq, in

requestedFor.id: eq, in

modified: gt, lt, ge, le, eq, in

sorters comma-separated

Sort results using the standard syntax described in V3 API Standard Collection Parameters

Sorting is supported for the following fields: created, modified

Responses

200

List of Pending Approvals.

application/json

Schema

Schema

Array [
idstring
The approval id.
Example: 2c9180835d2e5168015d32f890ca1581
namestring
The name of the approval.
Example: Pending approval name
createddate-time
When the approval was created.
Example: 2017-07-11T18:45:37.098Z
modifieddate-time
When the approval was modified last time.
Example: 2018-07-25T20:22:28.104Z
requestCreateddate-time
When the access-request was created.
Example: 2017-07-11T18:45:35.098Z
requestTypestringnullable
Access request type. Defaults to GRANT_ACCESS. REVOKE_ACCESS type can only have a single Identity ID in the requestedFor field.
Possible values: [GRANT_ACCESS, REVOKE_ACCESS, null]
Example: GRANT_ACCESS
requester object
Access item requester's identity.
typestring
Access item requester's DTO type.
Possible values: [IDENTITY]
Example: IDENTITY
idstring
Access item requester's identity ID.
Example: 2c7180a46faadee4016fb4e018c20648
namestring
Access item owner's human-readable display name.
Example: William Wilson
requestedFor object
Identity the access item is requested for.
typestring
DTO type of identity the access item is requested for.
Possible values: [IDENTITY]
Example: IDENTITY
idstring
ID of identity the access item is requested for.
Example: 2c4180a46faadee4016fb4e018c20626
namestring
Human-readable display name of identity the access item is requested for.
Example: Robert Robinson
owner object
Access item owner's identity.
typestring
Access item owner's DTO type.
Possible values: [IDENTITY]
Example: IDENTITY
idstring
Access item owner's identity ID.
Example: 2c9180a46faadee4016fb4e018c20639
namestring
Access item owner's human-readable display name.
Example: Support
requestedObject object
idstring
Id of the object.
Example: 2c938083633d259901633d25c68c00fa
namestring
Name of the object.
Example: Object Name
descriptionstring
Description of the object.
Example: Object Description
typestring
Type of the object.
Possible values: [ACCESS_PROFILE, ROLE, ENTITLEMENT]
Example: ROLE
requesterComment object
commentstringnullable
Comment content.
Example: This is a comment.
createddate-time
Date and time comment was created.
Example: 2017-07-11T18:45:37.098Z
author object
Author of the comment
typestring
The type of object
Possible values: [IDENTITY]
Example: IDENTITY
idstring
The unique ID of the object
Example: 2c9180847e25f377017e2ae8cae4650b
namestring
The display name of the object
Example: john.doe
previousReviewersComments object[]
The history of the previous reviewers comments.
Array [
commentstringnullable
Comment content.
Example: This is a comment.
createddate-time
Date and time comment was created.
Example: 2017-07-11T18:45:37.098Z
author object
Author of the comment
typestring
The type of object
Possible values: [IDENTITY]
Example: IDENTITY
idstring
The unique ID of the object
Example: 2c9180847e25f377017e2ae8cae4650b
namestring
The display name of the object
Example: john.doe
]
forwardHistory object[]
The history of approval forward action.
Array [
oldApproverNamestring
Display name of approver from whom the approval was forwarded.
Example: Frank Mir
newApproverNamestring
Display name of approver to whom the approval was forwarded.
Example: Al Volta
commentstringnullable
Comment made while forwarding.
Example: Forwarding from Frank to Al
modifieddate-time
Time at which approval was forwarded.
Example: 2019-08-23T18:52:57.398Z
forwarderNamestringnullable
Display name of forwarder who forwarded the approval.
Example: William Wilson
reassignmentTypestring
The approval reassignment type.
• MANUAL_REASSIGNMENT: An approval with this reassignment type has been specifically reassigned by the approval task's owner, from their queue to someone else's.
• AUTOMATIC_REASSIGNMENT: An approval with this reassignment type has been automatically reassigned from another approver's queue, according to that approver's reassignment configuration. The approver's reassignment configuration may be set up to automatically reassign approval tasks for a defined (or possibly open-ended) period of time.
• AUTO_ESCALATION: An approval with this reassignment type has been automatically reassigned from another approver's queue, according to the request's escalation configuration. For more information about escalation configuration, refer to Setting Global Reminders and Escalation Policies.
• SELF_REVIEW_DELEGATION: An approval with this reassignment type has been automatically reassigned by the system to prevent self-review. This helps prevent situations like a requester being tasked with approving their own request. For more information about preventing self-review, refer to Self-review Prevention and Preventing Self-approval.
Possible values: [MANUAL_REASSIGNMENT, AUTOMATIC_REASSIGNMENT, AUTO_ESCALATION, SELF_REVIEW_DELEGATION]
Example: AUTOMATIC_REASSIGNMENT
]
commentRequiredWhenRejectedboolean
When true the rejector has to provide comments when rejecting
Default value: false
Example: true
actionInProcessstring
Enum represents action that is being processed on an approval.
Possible values: [APPROVED, REJECTED, FORWARDED]
Example: APPROVED
removeDatedate-time
The date the role or access profile or entitlement is no longer assigned to the specified identity.
Example: 2020-07-11T00:00:00Z
removeDateUpdateRequestedboolean
If true, then the request is to change the remove date or sunset date.
Default value: false
Example: true
currentRemoveDatedate-time
The remove date or sunset date that was assigned at the time of the request.
Example: 2020-07-11T00:00:00Z
sodViolationContext objectnullable
An object referencing a completed SOD violation check
statestring
The status of SOD violation check
Possible values: [SUCCESS, ERROR]
Example: SUCCESS
uuidstring
The id of the Violation check event
Example: f73d16e9-a038-46c5-b217-1246e15fdbdd
violationCheckResult object
The inner object representing the completed SOD Violation check
message object
If the request failed, includes any error message that was generated.
localestringnullable
The locale for the message text, a BCP 47 language tag.
Example: en-US
localeOriginstringnullable
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
Possible values: [DEFAULT, REQUEST, null]
Example: DEFAULT
textstring
Actual text of the error message in the indicated locale.
Example: The request was syntactically correct but its content is semantically invalid.
clientMetadata object
Arbitrary key-value pairs. They will never be processed by the IdentityNow system but will be returned on completion of the violation check.
property name*string
violationContexts object[]
Array [
policy object
SOD policy.
typestring
SOD policy DTO type.
Possible values: [SOD_POLICY]
Example: SOD_POLICY
idstring
SOD policy ID.
Example: 0f11f2a4-7c94-4bf3-a2bd-742580fe3bde
namestring
SOD policy display name.
Example: Business SOD Policy
conflictingAccessCriteria object
The object which contains the left and right hand side of the entitlements that got violated according to the policy.
leftCriteria object
criteriaList object[]
Array [
existingboolean
If the entitlement already belonged to the user or not.
Default value: false
Example: true
typestring
An enumeration of the types of DTOs supported within the IdentityNow infrastructure.
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, MACHINE_IDENTITY, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
Example: ENTITLEMENT
idstring
Entitlement ID
Example: 2c918085771e9d3301773b3cb66f6398
namestring
Entitlement name
Example: My HR Entitlement
]
rightCriteria object
criteriaList object[]
Array [
existingboolean
If the entitlement already belonged to the user or not.
Default value: false
Example: true
typestring
An enumeration of the types of DTOs supported within the IdentityNow infrastructure.
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, MACHINE_IDENTITY, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
Example: ENTITLEMENT
idstring
Entitlement ID
Example: 2c918085771e9d3301773b3cb66f6398
namestring
Entitlement name
Example: My HR Entitlement
]
]
violatedPolicies object[]
A list of the Policies that were violated.
Array [
typestring
SOD policy DTO type.
Possible values: [SOD_POLICY]
Example: SOD_POLICY
idstring
SOD policy ID.
Example: 0f11f2a4-7c94-4bf3-a2bd-742580fe3bde
namestring
SOD policy display name.
Example: Business SOD Policy
]
clientMetadata objectnullable
Arbitrary key-value pairs, if any were included in the corresponding access request item
property name*string
requestedAccounts object[]nullable
The accounts selected by the user for the access to be provisioned on, in case they have multiple accounts on one or more sources.
Array [
namestring
Display name of the account for the user
Example: Glen.067da3248e914
typestring
The type of item
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, MACHINE_IDENTITY, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
Example: ACCOUNT
accountUuidstringnullable
The uuid for the account
Example: {fab7119e-004f-4822-9c33-b8d570d6c6a6}
accountIdstringnullable
The native identity for the account
Example: CN=Glen 067da3248e914,OU=YOUROU,OU=org-data-service,DC=YOURDC,DC=local
sourceNamestring
Display name of the source for the account
Example: Multi Account AD source name
]
]

Example (auto)

[
  {
    "id": "2c9180835d2e5168015d32f890ca1581",
    "name": "Pending approval name",
    "created": "2017-07-11T18:45:37.098Z",
    "modified": "2018-07-25T20:22:28.104Z",
    "requestCreated": "2017-07-11T18:45:35.098Z",
    "requestType": "GRANT_ACCESS",
    "requester": {
      "type": "IDENTITY",
      "id": "2c7180a46faadee4016fb4e018c20648",
      "name": "William Wilson"
    },
    "requestedFor": {
      "type": "IDENTITY",
      "id": "2c4180a46faadee4016fb4e018c20626",
      "name": "Robert Robinson"
    },
    "owner": {
      "type": "IDENTITY",
      "id": "2c9180a46faadee4016fb4e018c20639",
      "name": "Support"
    },
    "requestedObject": {
      "id": "2c938083633d259901633d25c68c00fa",
      "name": "Object Name",
      "description": "Object Description",
      "type": "ROLE"
    },
    "requesterComment": {
      "comment": "This is a comment.",
      "created": "2017-07-11T18:45:37.098Z",
      "author": {
        "type": "IDENTITY",
        "id": "2c9180847e25f377017e2ae8cae4650b",
        "name": "john.doe"
      }
    },
    "previousReviewersComments": [
      {
        "comment": "This is a comment.",
        "created": "2017-07-11T18:45:37.098Z",
        "author": {
          "type": "IDENTITY",
          "id": "2c9180847e25f377017e2ae8cae4650b",
          "name": "john.doe"
        }
      }
    ],
    "forwardHistory": [
      {
        "oldApproverName": "Frank Mir",
        "newApproverName": "Al Volta",
        "comment": "Forwarding from Frank to Al",
        "modified": "2019-08-23T18:52:57.398Z",
        "forwarderName": "William Wilson",
        "reassignmentType": "AUTOMATIC_REASSIGNMENT"
      }
    ],
    "commentRequiredWhenRejected": true,
    "actionInProcess": "APPROVED",
    "removeDate": "2020-07-11T00:00:00Z",
    "removeDateUpdateRequested": true,
    "currentRemoveDate": "2020-07-11T00:00:00Z",
    "sodViolationContext": {
      "state": "SUCCESS",
      "uuid": "f73d16e9-a038-46c5-b217-1246e15fdbdd",
      "violationCheckResult": {
        "message": [
          {
            "locale": "en-US",
            "localeOrigin": "DEFAULT",
            "text": "An error has occurred during the SOD violation check"
          }
        ],
        "clientMetadata": {
          "requestedAppName": "test-app",
          "requestedAppId": "2c91808f7892918f0178b78da4a305a1"
        },
        "violationContexts": [
          {
            "policy": {
              "type": "SOD_POLICY",
              "id": "0f11f2a4-7c94-4bf3-a2bd-742580fe3bde",
              "name": "Business SOD Policy"
            },
            "conflictingAccessCriteria": {
              "leftCriteria": {
                "criteriaList": [
                  {
                    "existing": true,
                    "type": "ENTITLEMENT",
                    "id": "2c918085771e9d3301773b3cb66f6398",
                    "name": "My HR Entitlement"
                  }
                ]
              },
              "rightCriteria": {
                "criteriaList": [
                  {
                    "existing": true,
                    "type": "ENTITLEMENT",
                    "id": "2c918085771e9d3301773b3cb66f6398",
                    "name": "My HR Entitlement"
                  }
                ]
              }
            }
          }
        ],
        "violatedPolicies": [
          {
            "type": "SOD_POLICY",
            "id": "0f11f2a4-7c94-4bf3-a2bd-742580fe3bde",
            "name": "Business SOD Policy"
          }
        ]
      }
    },
    "clientMetadata": {
      "customKey1": "custom value 1",
      "customKey2": "custom value 2"
    },
    "requestedAccounts": [
      {
        "name": "Glen.067da3248e914",
        "type": "ACCOUNT",
        "accountUuid": "{fab7119e-004f-4822-9c33-b8d570d6c6a6}",
        "accountId": "CN=Glen 067da3248e914,OU=YOUROU,OU=org-data-service,DC=YOURDC,DC=local",
        "sourceName": "Multi Account AD source name"
      }
    ]
  }
]

401

Unauthorized - Returned if there is no authorization header, or if the JWT token is expired.

application/json

Schema

Schema

error
A message describing the error
Example: JWT validation failed: JWT is expired

Example (auto)

{
  "error": "JWT validation failed: JWT is expired"
}

403

Forbidden - Returned if the user you are running as, doesn't have access to this end-point.

application/json

Schema

Schema

detailCodestring
Fine-grained error code providing more detail of the error.
Example: 400.1 Bad Request Content
trackingIdstring
Unique tracking id for the error.
Example: e7eab60924f64aa284175b9fa3309599
messages object[]
Generic localized reason for error
Array [
localestringnullable
The locale for the message text, a BCP 47 language tag.
Example: en-US
localeOriginstringnullable
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
Possible values: [DEFAULT, REQUEST, null]
Example: DEFAULT
textstring
Actual text of the error message in the indicated locale.
Example: The request was syntactically correct but its content is semantically invalid.
]
causes object[]
Plain-text descriptive reasons to provide additional detail to the text provided in the messages field
Array [
localestringnullable
The locale for the message text, a BCP 47 language tag.
Example: en-US
localeOriginstringnullable
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
Possible values: [DEFAULT, REQUEST, null]
Example: DEFAULT
textstring
Actual text of the error message in the indicated locale.
Example: The request was syntactically correct but its content is semantically invalid.
]

Example (auto)

{
  "detailCode": "400.1 Bad Request Content",
  "trackingId": "e7eab60924f64aa284175b9fa3309599",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ],
  "causes": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ]
}

403

An example of a 403 response object

{
  "detailCode": "403 Forbidden",
  "trackingId": "b21b1f7ce4da4d639f2c62a57171b427",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The server understood the request but refuses to authorize it."
    }
  ]
}

429

Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again.

application/json

Schema

Schema

message
A message describing the error
Example: Rate Limit Exceeded

Example (auto)

{
  "message": " Rate Limit Exceeded "
}

500

Internal Server Error - Returned if there is an unexpected error.

application/json

Schema

Schema

detailCodestring
Fine-grained error code providing more detail of the error.
Example: 400.1 Bad Request Content
trackingIdstring
Unique tracking id for the error.
Example: e7eab60924f64aa284175b9fa3309599
messages object[]
Generic localized reason for error
Array [
localestringnullable
The locale for the message text, a BCP 47 language tag.
Example: en-US
localeOriginstringnullable
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
Possible values: [DEFAULT, REQUEST, null]
Example: DEFAULT
textstring
Actual text of the error message in the indicated locale.
Example: The request was syntactically correct but its content is semantically invalid.
]
causes object[]
Plain-text descriptive reasons to provide additional detail to the text provided in the messages field
Array [
localestringnullable
The locale for the message text, a BCP 47 language tag.
Example: en-US
localeOriginstringnullable
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
Possible values: [DEFAULT, REQUEST, null]
Example: DEFAULT
textstring
Actual text of the error message in the indicated locale.
Example: The request was syntactically correct but its content is semantically invalid.
]

Example (auto)

{
  "detailCode": "400.1 Bad Request Content",
  "trackingId": "e7eab60924f64aa284175b9fa3309599",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ],
  "causes": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ]
}

500

An example of a 500 response object

{
  "detailCode": "500.0 Internal Fault",
  "trackingId": "b21b1f7ce4da4d639f2c62a57171b427",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "An internal fault occurred."
    }
  ]
}

Authorization: oauth2

type: Personal Access Token
scopes: sp:scopes:all

• go
• powershell
  SailPoint SDK
• python
  SailPoint SDK
• csharp
• curl
• dart
• http
• java
• javascript
• kotlin
• c
• nodejs
• objective-c
• ocaml
• php
• r
• ruby
• rust
• shell
• swift

• NATIVE

package main

import (
  "fmt"
  "net/http"
  "io"
)

func main() {

  url := "https://sailpoint.api.identitynow.com/beta/access-request-approvals/pending"
  method := "GET"

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, nil)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Accept", "application/json")
  req.Header.Add("Authorization", "Bearer <TOKEN>")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

Request Collapse all

Base URL

https://sailpoint.api.identitynow.com/beta

Auth

Bearer Token

Parameters

owner-id — query

limit — query

offset — query

count — query

---truefalse

filters — query

sorters — query

ResponseClear

Click the Send API Request button above and see the response here!