Skip to main content

Intelligence

Read-only HTTP API that returns the Intelligence (identity context) for SecOps enrichment use cases (SIEM/SOAR connectors, MCP, browser extension). Backed by Atlas internal-REST calls to MICE, Shelby List Accounts, SDS Search, IDA-outliers, and identity-history.

License-based segmentation​

  • idn:response-and-remediation (required): enforced on all /intelligence/* routes.
  • IDA-outliers (optional): governs the Human outliers.rareAccess slice only. When the tenant lacks this license, the outliers key is omitted.
  • idg:base (optional): governs the root-level identityGraph deep link on aggregate responses. When the tenant lacks this license, identityGraph is omitted.

Pagination​

The aggregated Human GET embeds the first 10 items per paged slice. Each upstream paged call sends count=true and reads X-Total-Count. Parent slices expose totalCount when items is non-empty and set next when totalCount > offset + len(items) (aggregate offset is always 0). Empty slices render as items: [] with no totalCount. privilegedAccess is never paged and carries no totalCount.

Human child routes (/accounts, /outliers/rare-access, /access-history/*) follow the SailPoint V3 pattern: pass count=true to receive X-Total-Count (including 0 on empty pages). When count is omitted, upstream count work is skipped and the header is omitted.