IntelligenceService
HTTP API that returns the Intelligence (identity context) for SecOps enrichment use cases (SIEM/SOAR connectors, MCP, browser extension), and accepts asynchronous response actions for remediation. Identity reads are backed by Atlas internal-REST calls to MICE, Shelby List Accounts, SDS Search, IDA-outliers, and identity-history.
License-based segmentation
- `idn:response-and-remediation` (required): enforced on all `/intelligence/*` routes.
- `IDA-outliers` (optional): governs the Human `outliers.rareAccess` slice only. When the tenant lacks this license, the `outliers` key is omitted.
- `idg:base` (optional): governs the root-level `identityGraph` deep link on aggregate responses. When the tenant lacks this license, `identityGraph` is omitted.
- `idn:machine-identity-security` (optional): governs the Human `nonHumanIdentityOwnership` slice. When the tenant lacks this license, `nonHumanIdentityOwnership` is omitted on the aggregate GET and the `/non-human-identity-ownership/{category}` child route returns 403 Forbidden.
Pagination
The aggregated Human GET embeds the first 10 items per paged slice. Each upstream paged call sends `count=true` and reads `X-Total-Count`. Parent slices expose `totalCount` when `items` is non-empty and set `next` when `totalCount > offset + len(items)` (aggregate offset is always 0). Empty slices render as `items: []` with no `totalCount`. `privilegedAccess` is never paged and carries no `totalCount`. When licensed, `nonHumanIdentityOwnership` pages each `primaryOwned` / `secondaryOwned` bucket independently under `agents` and `applications`.
Human child routes (`/accounts`, `/outliers/rare-access`, `/access-history/*`, `/non-human-identity-ownership/{category}`) follow the SailPoint V3 pattern: pass `count=true` to receive `X-Total-Count` (including `0` on empty pages). When `count` is omitted, upstream count work is skipped and the header is omitted.
Every method returns an Observable. All request paths are relative to the baseUrl you pass to provideSailPoint().
| Method | HTTP request | Description |
|---|---|---|
| create-response-action-v1 | POST /intelligence/v1/response-actions | Create a response action |
| get-identity-intelligence-v1 | GET /intelligence/v1/identities | Get identity by filter |
| get-intel-identity-access-item-history-v1 | GET /intelligence/v1/identities/{id}/access-history/access-items | List identity access item history |
| get-intel-identity-accounts-v1 | GET /intelligence/v1/identities/{id}/accounts | List identity accounts |
| get-intel-identity-certification-history-v1 | GET /intelligence/v1/identities/{id}/access-history/certifications | List identity certification history |
| get-intel-identity-non-human-identity-ownership-v1 | GET /intelligence/v1/identities/{id}/non-human-identity-ownership/{category} | List owned NHI identities |
| get-intel-identity-rare-access-v1 | GET /intelligence/v1/identities/{id}/outliers/rare-access | List identity rare access |
| get-response-action-status-v1 | GET /intelligence/v1/response-actions/{id}/status | Get response action status |
create-response-action-v1
Create a response action Requires tenant license idn:response-and-remediation.
Creates a response action: the request is validated, a requestId (the correlation id) is minted, the action is recorded as SUBMITTED, and an event is published that triggers the correlated workflow(s).
Returns HTTP 202 with the requestId, an initial SUBMITTED status, and a statusUrl. Poll GET /intelligence/v1/response-actions/{requestId}/status for progress.
Parameters
The service takes one object that holds every parameter. Its type is CreateResponseActionV1RequestParams.
| Name | Type | Description | Notes |
|---|---|---|---|
| responseactioncreaterequest | Responseactioncreaterequest |
Return type
Observable<Responseactionaccepted>
HTTP request headers
- Content-Type: application/json
- Accept: application/json
Example
import { Component, inject } from '@angular/core';
import { IntelligenceService } from '@sailpoint/angular-sdk/intelligence';
import { Responseactioncreaterequest } from '@sailpoint/angular-sdk/intelligence';
@Component({ selector: 'app-example', template: '' })
export class ExampleComponent {
private readonly api = inject(IntelligenceService);
createResponseActionV1(): void {
const responseactioncreaterequest: Responseactioncreaterequest = ; //
this.api.createResponseActionV1({ responseactioncreaterequest: responseactioncreaterequest }).subscribe({
next: (result) => console.log(result),
error: (error) => console.error(error),
});
}
}
get-identity-intelligence-v1
Get identity by filter Requires tenant license idn:response-and-remediation.
Authentication and data segmentation
Intelligence forwards the caller JWT to downstream identity and search services (context client). Enriched results, including non-human identity resolution, are filtered to the caller's Data Segmentation visibility.
Caution: Generic API Management API keys are not tied to a user identity. When Data Segmentation is enabled, API key authentication may fail or return incomplete data because downstream calls require a user context. Use a personal access token or other user-scoped OAuth token. See API keys and Data Segmentation.
Resolves exactly one identity using a single SCIM-style filters expression.
Supported filters
| Filter field | Lookup mode | Notes |
|---|---|---|
| id eq | Human (+ optional non-human identity when feature-flagged) | Resolves human identities by id; when non-human resolution is enabled, a parallel non-human lookup runs. If both match different identities, returns HTTP 409. |
| email eq | Human only | Human identity lookup by email only. |
| opaqueIdentifier eq | Non-human identity only | Parallel nativeIdentity eq on machine-identities and machine-accounts, then name-prefix fallback on machine-accounts. Requires feature flag ISCRR-1905_NHI_TYPE_MACHINE_FILTER_ENABLED; when disabled, returns HTTP 400. |
Single-clause filters only; composite and or expressions are rejected with HTTP 400.
identityGraph deep link
When the tenant has the idg:base license, Human and NHI aggregate responses may include
identityGraph.href, a deep link into the Identity Graph UI for the resolved identity.
Opening the link requires the Identity Graph Read Only user level. The link is omitted
when the tenant lacks idg:base.
Human envelope (type Human)
Embeds the first page (10 items) of each enrichment slice. Each paged slice includes totalCount from upstream X-Total-Count when items is non-empty, and carries a next continuation URL when totalCount exceeds the items returned on this page. Slices are always present (empty uses items [] with no totalCount). privilegedAccess returns the full privileged-access result and never carries next or totalCount. When the tenant has idn:machine-identity-security, nonHumanIdentityOwnership is included with agents and applications categories; each category is a flat object with independently paged primaryOwned and secondaryOwned buckets, and optional message/reason when upstream ownership fetch fails for that category (reason UPSTREAM_UNAVAILABLE). When the tenant lacks that license, nonHumanIdentityOwnership is omitted. Continue ownership paging with GET .../non-human-identity-ownership/{category} and optional ownershipRole=primary|secondary (defaults to primary). If any enrichment upstream fails, the whole request fails with HTTP 500, except outliers (omitted when the tenant lacks the IDA-outliers license) and nonHumanIdentityOwnership category-level degrade (aggregate still returns HTTP 200).
Non-human identity envelope (type NHI)
Returns flat non-human identity fields at the top level plus correlated machine accounts on the aggregate and a derived block (isOrphaned, authorizedHumanIdentities, blastRadiusSummary). Omits Human-only slices (privilegedAccess, outliers, accessHistory, nonHumanIdentityOwnership). Account paging via child routes is not yet released. Opaque prefix resolution that deduplicates to one parent identity returns HTTP 200 with matchConfidence partial; multiple distinct parent identities return HTTP 409 with IDC_IDENTITY_AMBIGUOUS and candidate id and displayName values.
Parameters
The service takes one object that holds every parameter. Its type is GetIdentityIntelligenceV1RequestParams.
| Name | Type | Description | Notes |
|---|---|---|---|
| filters | string | Filter results using the standard syntax described in V3 API Standard Collection Parameters Filtering is supported for the following fields and operators: id: eq email: eq opaqueIdentifier: eq | [default to undefined] |
Return type
Observable<Intelidentityenvelope>
HTTP request headers
- Content-Type: Not defined
- Accept: application/json
Example
import { Component, inject } from '@angular/core';
import { IntelligenceService } from '@sailpoint/angular-sdk/intelligence';
@Component({ selector: 'app-example', template: '' })
export class ExampleComponent {
private readonly api = inject(IntelligenceService);
getIdentityIntelligenceV1(): void {
const filters: string = ; // Filter results using the standard syntax described in [V3 API Standard Collection Parameters](https://developer.sailpoint.com/idn/api/standard-collection-parameters#filtering-results) Filtering is supported for the following fields and operators: **id**: *eq* **email**: *eq* **opaqueIdentifier**: *eq*
this.api.getIdentityIntelligenceV1({ filters: filters }).subscribe({
next: (result) => console.log(result),
error: (error) => console.error(error),
});
}
}
get-intel-identity-access-item-history-v1
List identity access item history
Continuation endpoint for the parent response's accessHistory.accessItems.next link.
Returns one page of access-item history events for the supplied limit and offset values.
Pass count=true to receive X-Total-Count (including 0 on empty pages).
Unsupported event types and per-record decode failures are dropped server-side.
Requires tenant license idn:response-and-remediation.
Not applicable to non-human identities.
Parameters
The service takes one object that holds every parameter. Its type is GetIntelIdentityAccessItemHistoryV1RequestParams.
| Name | Type | Description | Notes |
|---|---|---|---|
| id | string | Non-empty identity id path segment for Intelligence sub-resources. | [default to undefined] |
| limit | number | Page size. Defaults to 250; values above 250 are rejected with 400. | [optional] [default to 250] |
| offset | number | Zero-based page offset. Defaults to 0. | [optional] [default to 0] |
| count | boolean | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. | [optional] [default to false] |
Return type
Observable<Array<IntelAccessItemHistoryEvent>>
HTTP request headers
- Content-Type: Not defined
- Accept: application/json
Example
import { Component, inject } from '@angular/core';
import { IntelligenceService } from '@sailpoint/angular-sdk/intelligence';
@Component({ selector: 'app-example', template: '' })
export class ExampleComponent {
private readonly api = inject(IntelligenceService);
getIntelIdentityAccessItemHistoryV1(): void {
const id: string = ; // Non-empty identity id path segment for Intelligence sub-resources.
const limit: number = ; // Page size. Defaults to 250; values above 250 are rejected with 400. (optional)
const offset: number = ; // Zero-based page offset. Defaults to 0. (optional)
const count: boolean = ; // If *true* it will populate the *X-Total-Count* response header with the number of results that would be returned if *limit* and *offset* were ignored. Since requesting a total count can have a performance impact, it is recommended not to send **count=true** if that value will not be used. See [V3 API Standard Collection Parameters](https://developer.sailpoint.com/idn/api/standard-collection-parameters) for more information. (optional)
this.api.getIntelIdentityAccessItemHistoryV1({ id: id }).subscribe({
next: (result) => console.log(result),
error: (error) => console.error(error),
});
}
}
get-intel-identity-accounts-v1
List identity accounts
Continuation endpoint for a Human identity's accounts.next link.
Returns one page of account rows for the supplied limit and offset values.
Pass count=true to receive X-Total-Count (including 0 on empty pages).
Not applicable to non-human identities (NHI accounts are returned on the NHI aggregate only).
Requires tenant license idn:response-and-remediation.
Parameters
The service takes one object that holds every parameter. Its type is GetIntelIdentityAccountsV1RequestParams.
| Name | Type | Description | Notes |
|---|---|---|---|
| id | string | Non-empty identity id path segment for Intelligence sub-resources. | [default to undefined] |
| limit | number | Page size. Defaults to 250; values above 250 are rejected with 400. | [optional] [default to 250] |
| offset | number | Zero-based page offset. Defaults to 0. | [optional] [default to 0] |
| count | boolean | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. | [optional] [default to false] |
Return type
Observable<Array<IntelAccessAccountWire>>
HTTP request headers
- Content-Type: Not defined
- Accept: application/json
Example
import { Component, inject } from '@angular/core';
import { IntelligenceService } from '@sailpoint/angular-sdk/intelligence';
@Component({ selector: 'app-example', template: '' })
export class ExampleComponent {
private readonly api = inject(IntelligenceService);
getIntelIdentityAccountsV1(): void {
const id: string = ; // Non-empty identity id path segment for Intelligence sub-resources.
const limit: number = ; // Page size. Defaults to 250; values above 250 are rejected with 400. (optional)
const offset: number = ; // Zero-based page offset. Defaults to 0. (optional)
const count: boolean = ; // If *true* it will populate the *X-Total-Count* response header with the number of results that would be returned if *limit* and *offset* were ignored. Since requesting a total count can have a performance impact, it is recommended not to send **count=true** if that value will not be used. See [V3 API Standard Collection Parameters](https://developer.sailpoint.com/idn/api/standard-collection-parameters) for more information. (optional)
this.api.getIntelIdentityAccountsV1({ id: id }).subscribe({
next: (result) => console.log(result),
error: (error) => console.error(error),
});
}
}
get-intel-identity-certification-history-v1
List identity certification history
Continuation endpoint for the parent response's accessHistory.certifications.next link.
Returns one page of certification history events for the supplied limit and offset values.
Pass count=true to receive X-Total-Count (including 0 on empty pages).
Per-record decode failures are dropped server-side.
Requires tenant license idn:response-and-remediation.
Not applicable to non-human identities.
Parameters
The service takes one object that holds every parameter. Its type is GetIntelIdentityCertificationHistoryV1RequestParams.
| Name | Type | Description | Notes |
|---|---|---|---|
| id | string | Non-empty identity id path segment for Intelligence sub-resources. | [default to undefined] |
| limit | number | Page size. Defaults to 250; values above 250 are rejected with 400. | [optional] [default to 250] |
| offset | number | Zero-based page offset. Defaults to 0. | [optional] [default to 0] |
| count | boolean | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. | [optional] [default to false] |
Return type
Observable<Array<IntelCertificationHistoryEvent>>
HTTP request headers
- Content-Type: Not defined
- Accept: application/json
Example
import { Component, inject } from '@angular/core';
import { IntelligenceService } from '@sailpoint/angular-sdk/intelligence';
@Component({ selector: 'app-example', template: '' })
export class ExampleComponent {
private readonly api = inject(IntelligenceService);
getIntelIdentityCertificationHistoryV1(): void {
const id: string = ; // Non-empty identity id path segment for Intelligence sub-resources.
const limit: number = ; // Page size. Defaults to 250; values above 250 are rejected with 400. (optional)
const offset: number = ; // Zero-based page offset. Defaults to 0. (optional)
const count: boolean = ; // If *true* it will populate the *X-Total-Count* response header with the number of results that would be returned if *limit* and *offset* were ignored. Since requesting a total count can have a performance impact, it is recommended not to send **count=true** if that value will not be used. See [V3 API Standard Collection Parameters](https://developer.sailpoint.com/idn/api/standard-collection-parameters) for more information. (optional)
this.api.getIntelIdentityCertificationHistoryV1({ id: id }).subscribe({
next: (result) => console.log(result),
error: (error) => console.error(error),
});
}
}
get-intel-identity-non-human-identity-ownership-v1
List owned NHI identities
Continuation endpoint for a human parent's
nonHumanIdentityOwnership.{category}.primaryOwned.next or
nonHumanIdentityOwnership.{category}.secondaryOwned.next link. Returns a bare JSON array of
owned non-human identity summary rows for the given category, optional ownershipRole,
limit, and offset. Wire items match the aggregate ownership item shape
({ id, displayName, source? }).
When ownershipRole is omitted, the request defaults to primary. Pass count=true to
receive X-Total-Count (including 0 on empty pages). The filters query parameter is not
supported on this route (HTTP 400).
Requires tenant licenses idn:response-and-remediation and idn:machine-identity-security.
Tenants without idn:machine-identity-security receive HTTP 403.
Not applicable to non-human identities (no ownership slice on the NHI envelope).
Parameters
The service takes one object that holds every parameter. Its type is GetIntelIdentityNonHumanIdentityOwnershipV1RequestParams.
| Name | Type | Description | Notes |
|---|---|---|---|
| id | string | Non-empty identity id path segment for Intelligence sub-resources. | [default to undefined] |
| category | `'agents' | 'applications'` | Non-human identity ownership category. Use `agents` for AI Agent subtypes and `applications` for Application subtypes. |
| ownershipRole | `'primary' | 'secondary'` | Optional ownership role discriminator. When set to `primary` or `secondary`, returns one paged role bucket. When omitted, defaults to `primary`. |
| limit | number | Page size. Defaults to 250; values above 250 are rejected with 400. | [optional] [default to 250] |
| offset | number | Zero-based page offset. Defaults to 0. | [optional] [default to 0] |
| count | boolean | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. | [optional] [default to false] |
Return type
Observable<Array<Intelnonhumanidentityownershipitem>>
HTTP request headers
- Content-Type: Not defined
- Accept: application/json
Example
import { Component, inject } from '@angular/core';
import { IntelligenceService } from '@sailpoint/angular-sdk/intelligence';
@Component({ selector: 'app-example', template: '' })
export class ExampleComponent {
private readonly api = inject(IntelligenceService);
getIntelIdentityNonHumanIdentityOwnershipV1(): void {
const id: string = ; // Non-empty identity id path segment for Intelligence sub-resources.
const category: string = ; // Non-human identity ownership category. Use `agents` for AI Agent subtypes and `applications` for Application subtypes.
const ownershipRole: string = ; // Optional ownership role discriminator. When set to `primary` or `secondary`, returns one paged role bucket. When omitted, defaults to `primary`. (optional)
const limit: number = ; // Page size. Defaults to 250; values above 250 are rejected with 400. (optional)
const offset: number = ; // Zero-based page offset. Defaults to 0. (optional)
const count: boolean = ; // If *true* it will populate the *X-Total-Count* response header with the number of results that would be returned if *limit* and *offset* were ignored. Since requesting a total count can have a performance impact, it is recommended not to send **count=true** if that value will not be used. See [V3 API Standard Collection Parameters](https://developer.sailpoint.com/idn/api/standard-collection-parameters) for more information. (optional)
this.api.getIntelIdentityNonHumanIdentityOwnershipV1({ id: id, category: category }).subscribe({
next: (result) => console.log(result),
error: (error) => console.error(error),
});
}
}
get-intel-identity-rare-access-v1
List identity rare access
Continuation endpoint for the parent response's outliers.rareAccess.next link.
Resolves the identity's first outlier, then returns one page of rare access
items for the supplied limit and offset values. Pass count=true to receive
X-Total-Count (including 0 on empty pages). An identity with no outlier
returns an empty array with X-Total-Count: 0 when count=true. Requires
tenant license idn:response-and-remediation and the IDA-outliers license.
Not applicable to non-human identities (no outliers slice on the NHI envelope).
Parameters
The service takes one object that holds every parameter. Its type is GetIntelIdentityRareAccessV1RequestParams.
| Name | Type | Description | Notes |
|---|---|---|---|
| id | string | Non-empty identity id path segment for Intelligence sub-resources. | [default to undefined] |
| limit | number | Page size. Defaults to 250; values above 250 are rejected with 400. | [optional] [default to 250] |
| offset | number | Zero-based page offset. Defaults to 0. | [optional] [default to 0] |
| count | boolean | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. | [optional] [default to false] |
Return type
Observable<Array<IntelOutlierAccessItem>>
HTTP request headers
- Content-Type: Not defined
- Accept: application/json
Example
import { Component, inject } from '@angular/core';
import { IntelligenceService } from '@sailpoint/angular-sdk/intelligence';
@Component({ selector: 'app-example', template: '' })
export class ExampleComponent {
private readonly api = inject(IntelligenceService);
getIntelIdentityRareAccessV1(): void {
const id: string = ; // Non-empty identity id path segment for Intelligence sub-resources.
const limit: number = ; // Page size. Defaults to 250; values above 250 are rejected with 400. (optional)
const offset: number = ; // Zero-based page offset. Defaults to 0. (optional)
const count: boolean = ; // If *true* it will populate the *X-Total-Count* response header with the number of results that would be returned if *limit* and *offset* were ignored. Since requesting a total count can have a performance impact, it is recommended not to send **count=true** if that value will not be used. See [V3 API Standard Collection Parameters](https://developer.sailpoint.com/idn/api/standard-collection-parameters) for more information. (optional)
this.api.getIntelIdentityRareAccessV1({ id: id }).subscribe({
next: (result) => console.log(result),
error: (error) => console.error(error),
});
}
}
get-response-action-status-v1
Get response action status Requires tenant license idn:response-and-remediation.
Returns the current aggregate status of a previously submitted response action, identified by the requestId returned from POST /intelligence/v1/response-actions.
Supported actionType values: DISABLE_IDENTITY, DISABLE_ACCOUNT.
Parameters
The service takes one object that holds every parameter. Its type is GetResponseActionStatusV1RequestParams.
| Name | Type | Description | Notes |
|---|---|---|---|
| id | string | The requestId of the response action to look up. | [default to undefined] |
Return type
Observable<Responseactionstatus>
HTTP request headers
- Content-Type: Not defined
- Accept: application/json
Example
import { Component, inject } from '@angular/core';
import { IntelligenceService } from '@sailpoint/angular-sdk/intelligence';
@Component({ selector: 'app-example', template: '' })
export class ExampleComponent {
private readonly api = inject(IntelligenceService);
getResponseActionStatusV1(): void {
const id: string = ; // The requestId of the response action to look up.
this.api.getResponseActionStatusV1({ id: id }).subscribe({
next: (result) => console.log(result),
error: (error) => console.error(error),
});
}
}