CertificationCampaignsAPI

Use this API to implement certification campaign functionality. With this functionality in place, administrators can create, customize, and manage certification campaigns for their organizations' use. Certification campaigns provide Identity Security Cloud users with an interactive review process they can use to identify and verify access to systems. Campaigns help organizations reduce risk of inappropriate access and satisfy audit requirements.

A certification refers to Identity Security Cloud's mechanism for reviewing a user's access to entitlements (sets of permissions) and approving or removing that access. These certifications serve as a way of showing that a user's access has been reviewed and approved. Multiple certifications by different reviewers are often required to approve a user's access. A set of multiple certifications is called a certification campaign.

For example, an organization may use a Manager Certification campaign as a way of showing that a user's access has been reviewed and approved by multiple managers. Once this campaign has been completed, Identity Security Cloud would provision all the access the user needs, nothing more.

Identity Security Cloud provides two simple campaign types users can create without using search queries, Manager and Source Owner campaigns:

You can create these types of campaigns without using any search queries in Identity Security Cloud:

ManagerCampaign: Identity Security Cloud provides this campaign type as a way to ensure that an identity's access is certified by their managers. You only need to provide a name and description to create one.
Source Owner Campaign: Identity Security Cloud provides this campaign type as a way to ensure that an identity's access to a source is certified by its source owners. You only need to provide a name and description to create one. You can specify the sources whose owners you want involved or just run it across all sources.

For more information about these campaign types, refer to Starting a Manager or Source Owner Campaign.

One useful way to create certification campaigns in Identity Security Cloud is to use a specific search and then run a campaign on the results returned by that search. This allows you to be much more specific about whom you are certifying in your campaigns and what access you are certifying in your campaigns. For example, you can search for all identities who are managed by "Amanda.Ross" and also have the access to the "Accounting" role and then run a certification campaign based on that search to ensure that the returned identities are appropriately certified.

You can use Identity Security Cloud search queries to create these types of campaigns:

Identities: Use this campaign type to review and revoke access items for specific identities. You can either build a search query and create a campaign certifying all identities returned by that query, or you can search for individual identities and add those identities to the certification campaign.
Access Items: Use this campaign type to review and revoke a set of roles, access profiles, or entitlements from the identities that have them. You can either build a search query and create a campaign certifying all access items returned by that query, or you can search for individual access items and add those items to the certification campaign.
Role Composition: Use this campaign type to review a role's composition, including its title, description, and membership criteria. You can either build a search query and create a campaign certifying all roles returned by that query, or you can search for individual roles and add those roles to the certification campaign.
Uncorrelated Accounts: Use this campaign type to certify source accounts that aren't linked to an authoritative identity in Identity Security Cloud. You can use this campaign type to view all the uncorrelated accounts for a source and certify them.

For more information about search-based campaigns, refer to Starting a Campaign from Search.

Once you have generated your campaign, it becomes available for preview. An administrator can review the campaign and make changes, or if it's ready and accurate, activate it.

Once the campaign is active, organization administrators or certification administrators can designate other Identity Security Cloud users as certification reviewers. Those reviewers can view any of the certifications they either need to review (active) or have already reviewed (completed).

When a certification campaign is in progress, certification reviewers see the listed active certifications whose involved identities they can review. Reviewers can then make decisions to grant or revoke access, as well as reassign the certification to another reviewer. If the reviewer chooses this option, they must provide a reason for reassignment in the form of a comment.

Once a reviewer has made decisions on all the certification's involved access items, he or she must "Sign Off" to complete the review process. Doing so converts the certification into read-only status, preventing any further changes to the review decisions and deleting the work item (task) from the reviewer's list of work items.

Once all the reviewers have signed off, the certification campaign either completes or, if any reviewers decided to revoke access for any of the involved identities, it moves into a remediation phase. In the remediation phase, identities' entitlements are altered to remove any entitlements marked for revocation. In this situation, the certification campaign completes once all the remediation requests are completed.

The end of a certification campaign is determined by its deadline, its completion status, or by an administrator's decision.

For more information about certifications and certification campaigns, refer to Certifications.

All URIs are relative to https://sailpoint.api.identitynow.com/v2024

Method	HTTP request	Description
complete-campaign	Post `/campaigns/{id}/complete`	Complete a Campaign
create-campaign	Post `/campaigns`	Create a campaign
create-campaign-template	Post `/campaign-templates`	Create a Campaign Template
delete-campaign-template	Delete `/campaign-templates/{id}`	Delete a Campaign Template
delete-campaign-template-schedule	Delete `/campaign-templates/{id}/schedule`	Delete Campaign Template Schedule
delete-campaigns	Post `/campaigns/delete`	Delete Campaigns
get-active-campaigns	Get `/campaigns`	List Campaigns
get-campaign	Get `/campaigns/{id}`	Get Campaign
get-campaign-reports	Get `/campaigns/{id}/reports`	Get Campaign Reports
get-campaign-reports-config	Get `/campaigns/reports-configuration`	Get Campaign Reports Configuration
get-campaign-template	Get `/campaign-templates/{id}`	Get a Campaign Template
get-campaign-template-schedule	Get `/campaign-templates/{id}/schedule`	Get Campaign Template Schedule
get-campaign-templates	Get `/campaign-templates`	List Campaign Templates
move	Post `/campaigns/{id}/reassign`	Reassign Certifications
patch-campaign-template	Patch `/campaign-templates/{id}`	Update a Campaign Template
set-campaign-reports-config	Put `/campaigns/reports-configuration`	Set Campaign Reports Configuration
set-campaign-template-schedule	Put `/campaign-templates/{id}/schedule`	Set Campaign Template Schedule
start-campaign	Post `/campaigns/{id}/activate`	Activate a Campaign
start-campaign-remediation-scan	Post `/campaigns/{id}/run-remediation-scan`	Run Campaign Remediation Scan
start-campaign-report	Post `/campaigns/{id}/run-report/{type}`	Run Campaign Report
start-generate-campaign-template	Post `/campaign-templates/{id}/generate`	Generate a Campaign from Template
update-campaign	Patch `/campaigns/{id}`	Update a Campaign

complete-campaign

Complete a Campaign

caution

This endpoint will run successfully for any campaigns that are past due.

This endpoint will return a content error if the campaign is not past due.

Use this API to complete a certification campaign. This functionality is provided to admins so that they can complete a certification even if all items have not been completed.

API Spec

Path Parameters

Name	Type	Description	Notes
ctx	context.Context	context for authentication, logging, cancellation, deadlines, tracing, etc.
id	string	Campaign ID.

Other Parameters

Other parameters are passed through a pointer to a apiCompleteCampaignRequest struct via the builder pattern

Name	Type	Description	Notes

campaignCompleteOptions | CampaignCompleteOptions | Optional. Default behavior is for the campaign to auto-approve upon completion, unless autoCompleteAction=REVOKE |

Return type

map[string]interface

HTTP request headers

Content-Type: application/json
Accept: application/json

Example

package main

import (
	"context"
	"fmt"
	"os"
  
    
	sailpoint "github.com/sailpoint-oss/golang-sdk/v2"
)

func main() {
    id := `ef38f94347e94562b5bb8424a56397d8` // string | Campaign ID. # string | Campaign ID.
    campaigncompleteoptions := []byte(`{
          "autoCompleteAction" : "REVOKE"
        }`) // CampaignCompleteOptions | Optional. Default behavior is for the campaign to auto-approve upon completion, unless autoCompleteAction=REVOKE (optional)

    

    configuration := sailpoint.NewDefaultConfiguration()
    apiClient := sailpoint.NewAPIClient(configuration)
    resp, r, err := apiClient.V2024.CertificationCampaignsAPI.CompleteCampaign(context.Background(), id).Execute()
	  //resp, r, err := apiClient.V2024.CertificationCampaignsAPI.CompleteCampaign(context.Background(), id).CampaignCompleteOptions(campaignCompleteOptions).Execute()
    if err != nil {
	    fmt.Fprintf(os.Stderr, "Error when calling `CertificationCampaignsAPI.CompleteCampaign``: %v\n", err)
	    fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
    }
    // response from `CompleteCampaign`: map[string]interface{}
    fmt.Fprintf(os.Stdout, "Response from `CertificationCampaignsAPI.CompleteCampaign`: %v\n", resp)
}

Name	Type	Description	Notes
detail	string	Determines whether slim, or increased level of detail is provided for each campaign in the returned list. Slim is the default behavior.
limit	int32	Max number of results to return. See V3 API Standard Collection Parameters for more information.	[default to 250]
offset	int32	Offset into the full result set. Usually specified with limit to paginate through the results. See V3 API Standard Collection Parameters for more information.	[default to 0]
count	bool	If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information.	[default to false]
filters	string	Filter results using the standard syntax described in V3 API Standard Collection Parameters Filtering is supported for the following fields and operators: id: eq, in name: eq, sw status: eq, in
sorters	string	Sort results using the standard syntax described in V3 API Standard Collection Parameters Sorting is supported for the following fields: name, created

complete-campaign​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

create-campaign​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

create-campaign-template​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

delete-campaign-template​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

delete-campaign-template-schedule​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

delete-campaigns​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

get-active-campaigns​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

get-campaign​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

get-campaign-reports​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

get-campaign-reports-config​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

get-campaign-template​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

get-campaign-template-schedule​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

get-campaign-templates​

Path Parameters​

Other Parameters​

Return type​

HTTP request headers​

Example​

move​

Path Parameters​

complete-campaign

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

create-campaign

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

create-campaign-template

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

delete-campaign-template

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

delete-campaign-template-schedule

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

delete-campaigns

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

get-active-campaigns

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

get-campaign

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

get-campaign-reports

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

get-campaign-reports-config

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

get-campaign-template

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

get-campaign-template-schedule

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

get-campaign-templates

Path Parameters

Other Parameters

Return type

HTTP request headers

Example

move

Path Parameters