All URIs are relative to https://sailpoint.api.identitynow.com
create-machine-identity-v1
This API is currently in an experimental state. The API is subject to change based on feedback and further testing. You must include the X-SailPoint-Experimental header and set it to true to use this endpoint.
Use this API to create a machine identity.
The maximum supported length for the description field is 2000 characters.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| XSailPointExperimental | String | True (default to "true") | Use this header to enable this experimental API. | |
| Body | MachineIdentityRequest | MachineIdentityRequest | True | |
Return type
MachineIdentityResponse
Responses
| Code | Description | Data Type |
|---|
| 200 | Machine Identity created. | MachineIdentityResponse |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: application/json
- Accept: application/json
Example
$XSailPointExperimental = "true"
$MachineIdentityRequest = @"{
"sourceId" : "6d28b7c1-620c-49c6-b6d5-cbf81eb4b5fa",
"subtype" : "Application",
"created" : "2015-05-28T14:07:17Z",
"userEntitlements" : [ {
"sourceId" : "5898b7c1-620c-49c6-cccc-cbf81eb4bddd",
"entitlementId" : "6d28b7c1-620c-49c6-b6d5-cbf81eb4b5fa"
}, {
"sourceId" : "5898b7c1-620c-49c6-cccc-cbf81eb4bddd",
"entitlementId" : "6d28b7c1-620c-49c6-b6d5-cbf81eb4b5fa"
} ],
"name" : "aName",
"modified" : "2015-05-28T14:07:17Z",
"description" : "",
"attributes" : "{\"Region\":\"EU\"}",
"owners" : {
"primaryIdentity" : "{}",
"secondaryIdentities" : [ {
"name" : "William Wilson",
"id" : "2c91808568c529c60168cca6f90c1313",
"type" : "IDENTITY"
}, {
"name" : "William Wilson",
"id" : "2c91808568c529c60168cca6f90c1313",
"type" : "IDENTITY"
} ]
},
"id" : "id12345",
"uuid" : "f5dd23fe-3414-42b7-bb1c-869400ad7a10",
"nativeIdentity" : "abc:123:dddd"
}"@
try {
$Result = ConvertFrom-JsonToMachineIdentityRequest -Json $MachineIdentityRequest
New-MachineIdentityV1 -XSailPointExperimental $XSailPointExperimental -MachineIdentityRequest $Result
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling New-MachineIdentityV1"
Write-Host $_.ErrorDetails
}
[Back to top]
create-machine-identity-v2
Use this API to create a machine identity. Additional owners may be either up to ten human (IDENTITY) references or exactly one GOVERNANCE_GROUP reference - not both. The maximum supported length for the description field is 2000 characters.
When Business Applications is enabled for the tenant, callers may optionally include a single businessApplicationRefs entry (type=BUSINESS_APPLICATION, id=BA UUID). The assignment is stored as a MANUAL correlation. correlationType may be omitted or MANUAL; AUTOMATIC is rejected (400). Unknown BA id returns 404. More than one ref returns 400. When Business Applications is not enabled, supplying businessApplicationRefs returns 400. sanctionedStatus and effectiveSanctionedStatus are read-only and ignored on input.
API Spec
Parameters
Return type
Machineidentityv2
Responses
| Code | Description | Data Type |
|---|
| 201 | Machine identity created (same schema family as v2 GET/PATCH). | Machineidentityv2 |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: application/json
- Accept: application/json
Example
$Machineidentityv2 = @"{
"sourceId" : "6d28b7c1-620c-49c6-b6d5-cbf81eb4b5fa",
"resource" : {
"features" : [ "PROVISIONING", "AUTHENTICATION" ],
"name" : "nightly-batch-role",
"id" : "8886e5e3-63d0-462f-a195-d98da885b8dc",
"type" : "aws:iam-role"
},
"created" : "2015-05-28T14:07:17Z",
"connectorAttributes" : {
"objectguid" : "abc-123"
},
"description" : "Service account for nightly batch jobs",
"owners" : {
"secondary" : [ {
"id" : "2c9180858082150f0180893dbaf44202",
"name" : "Jane Doe",
"type" : "IDENTITY"
} ],
"primary" : {
"name" : "William Wilson",
"id" : "2c91808568c529c60168cca6f90c1313",
"type" : "IDENTITY"
}
},
"source" : {
"name" : "William Wilson",
"id" : "2c91808568c529c60168cca6f90c1313",
"type" : "IDENTITY"
},
"uuid" : "f5dd23fe-3414-42b7-bb1c-869400ad7a10",
"nativeIdentity" : "abc:123:dddd",
"effectiveSanctionedStatus" : "SANCTIONED",
"environment" : "PRODUCTION",
"subtype" : "AI_AGENT",
"businessApplicationRefs" : [ {
"name" : "Cursor",
"correlationType" : "MANUAL",
"id" : "2ee5e239-e68c-4d69-93fb-6c7ce4576190",
"type" : "BUSINESS_APPLICATION",
"sanctionedStatus" : "SANCTIONED"
} ],
"userEntitlements" : [ {
"sourceId" : "5898b7c1-620c-49c6-cccc-cbf81eb4bddd",
"displayName" : "Entitlement Name",
"entitlementId" : "6d28b7c1-620c-49c6-b6d5-cbf81eb4b5fa",
"source" : {
"name" : "William Wilson",
"id" : "2c91808568c529c60168cca6f90c1313",
"type" : "IDENTITY"
}
}, {
"sourceId" : "5898b7c1-620c-49c6-cccc-cbf81eb4bddd",
"displayName" : "Entitlement Name",
"entitlementId" : "6d28b7c1-620c-49c6-b6d5-cbf81eb4b5fa",
"source" : {
"name" : "William Wilson",
"id" : "2c91808568c529c60168cca6f90c1313",
"type" : "IDENTITY"
}
} ],
"name" : "aName",
"modified" : "2015-05-28T14:07:17Z",
"datasetId" : "8886e5e3-63d0-462f-a195-d98da885b8dc",
"attributes" : {
"privilegeLevel" : "HIGH",
"region" : "APAC"
},
"risk" : {
"severity" : "HIGH",
"score" : 72.5
},
"id" : "id12345",
"manuallyEdited" : true,
"manuallyCreated" : true,
"existsOnSource" : "TRUE",
"status" : "ACTIVE"
}"@
try {
$Result = ConvertFrom-JsonToMachineidentityv2 -Json $Machineidentityv2
New-MachineIdentityV2 -Machineidentityv2 $Result
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling New-MachineIdentityV2"
Write-Host $_.ErrorDetails
}
[Back to top]
delete-machine-identity-v1
This API is currently in an experimental state. The API is subject to change based on feedback and further testing. You must include the X-SailPoint-Experimental header and set it to true to use this endpoint.
The API returns successful response if the requested machine identity was deleted.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | Id | String | True | Machine Identity ID |
| XSailPointExperimental | String | True (default to "true") | Use this header to enable this experimental API. | |
Return type
(empty response body)
Responses
| Code | Description | Data Type |
|---|
| 204 | No content - indicates the request was successful but there is no content to be returned in the response. | |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$Id = "ef38f94347e94562b5bb8424a56397d8"
$XSailPointExperimental = "true"
try {
Remove-MachineIdentityV1 -Id $Id -XSailPointExperimental $XSailPointExperimental
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Remove-MachineIdentityV1"
Write-Host $_.ErrorDetails
}
[Back to top]
delete-machine-identity-v2
The API returns a successful response if the requested machine identity was deleted.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | Id | String | True | Machine Identity ID. |
Return type
(empty response body)
Responses
| Code | Description | Data Type |
|---|
| 204 | No content - indicates the request was successful but there is no content to be returned in the response. | |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$Id = "ef38f94347e94562b5bb8424a56397d8"
try {
Remove-MachineIdentityV2 -Id $Id
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Remove-MachineIdentityV2"
Write-Host $_.ErrorDetails
}
[Back to top]
delete-ownership-correlation-config-v1
Deletes the ownership correlation config with the specified ID for the given source resource.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | SourceId | String | True | The Source ID. |
| Path | ResourceId | String | True | The source resource ID (for example, account or aws:iam-role). |
| Path | ConfigId | String | True | The correlation config ID. |
Return type
(empty response body)
Responses
| Code | Description | Data Type |
|---|
| 204 | No content - indicates the request was successful but there is no content to be returned in the response. | |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$SourceId = "2c9180835d191a86015d28455b4a2329"
$ResourceId = "aws:iam-role"
$ConfigId = "f5dd23fe-3414-42b7-bb1c-869400ad7a10"
try {
Remove-OwnershipCorrelationConfigV1 -SourceId $SourceId -ResourceId $ResourceId -ConfigId $ConfigId
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Remove-OwnershipCorrelationConfigV1"
Write-Host $_.ErrorDetails
}
[Back to top]
get-machine-identity-v1
This API is currently in an experimental state. The API is subject to change based on feedback and further testing. You must include the X-SailPoint-Experimental header and set it to true to use this endpoint.
This API returns a single machine identity using the Machine Identity ID.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | Id | String | True | Machine Identity ID |
| XSailPointExperimental | String | True (default to "true") | Use this header to enable this experimental API. | |
Return type
MachineIdentityResponse
Responses
| Code | Description | Data Type |
|---|
| 200 | A machine identity object | MachineIdentityResponse |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$Id = "ef38f94347e94562b5bb8424a56397d8"
$XSailPointExperimental = "true"
try {
Get-MachineIdentityV1 -Id $Id -XSailPointExperimental $XSailPointExperimental
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Get-MachineIdentityV1"
Write-Host $_.ErrorDetails
}
[Back to top]
get-machine-identity-v2
This API returns a single machine identity using the Machine Identity ID.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | Id | String | True | Machine Identity ID. |
Return type
Machineidentityv2
Responses
| Code | Description | Data Type |
|---|
| 200 | A machine identity object. | Machineidentityv2 |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$Id = "ef38f94347e94562b5bb8424a56397d8"
try {
Get-MachineIdentityV2 -Id $Id
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Get-MachineIdentityV2"
Write-Host $_.ErrorDetails
}
[Back to top]
get-ownership-correlation-config-v1
This end-point retrieves a single ownership correlation config by ID for the specified source resource.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | SourceId | String | True | The Source ID. |
| Path | ResourceId | String | True | The source resource ID (for example, account or aws:iam-role). |
| Path | ConfigId | String | True | The correlation config ID. |
Return type
CorrelationConfig
Responses
| Code | Description | Data Type |
|---|
| 200 | The requested correlation config. | CorrelationConfig |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$SourceId = "2c9180835d191a86015d28455b4a2329"
$ResourceId = "aws:iam-role"
$ConfigId = "f5dd23fe-3414-42b7-bb1c-869400ad7a10"
try {
Get-OwnershipCorrelationConfigV1 -SourceId $SourceId -ResourceId $ResourceId -ConfigId $ConfigId
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Get-OwnershipCorrelationConfigV1"
Write-Host $_.ErrorDetails
}
[Back to top]
list-machine-identities-v1
This API is currently in an experimental state. The API is subject to change based on feedback and further testing. You must include the X-SailPoint-Experimental header and set it to true to use this endpoint.
This API returns a list of machine identities.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| XSailPointExperimental | String | True (default to "true") | Use this header to enable this experimental API. | |
| Query | Filters | String | (optional) | Filter results using the standard syntax described in V3 API Standard Collection Parameters Filtering is supported for the following fields and operators: id: eq, in, sw displayName: eq, in, sw cisIdentityId: eq, in, sw nativeIdentity: eq, in, sw attributes: eq manuallyEdited: eq subtype: eq, in owners.primaryIdentity.id: eq, in, sw owners.primaryIdentity.name: eq, in, isnull, pr owners.secondaryIdentity.id: eq, in, sw owners.secondaryIdentity.name: eq, in, isnull, pr source.name: eq, in, sw source.id: eq, in entitlement.id: eq, in entitlement.name: eq, in, sw |
| Query | Sorters | String | (optional) | Sort results using the standard syntax described in V3 API Standard Collection Parameters Sorting is supported for the following fields: nativeIdentity, name, owners.primaryIdentity.name, source.name, created, modified |
| Query | Count | Boolean | (optional) (default to $false) | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. |
| Query | Limit | Int32 | (optional) (default to 250) | Max number of results to return. See V3 API Standard Collection Parameters for more information. |
| Query | Offset | Int32 | (optional) (default to 0) | Offset into the full result set. Usually specified with limit to paginate through the results. See V3 API Standard Collection Parameters for more information. |
Return type
MachineIdentityResponse[]
Responses
| Code | Description | Data Type |
|---|
| 200 | List of machine identities. | MachineIdentityResponse[] |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$XSailPointExperimental = "true"
$Filters = 'identityId eq "2c9180858082150f0180893dbaf44201"'
$Sorters = "nativeIdentity"
$Count = $true
$Limit = 250
$Offset = 0
try {
Get-MachineIdentitiesV1 -XSailPointExperimental $XSailPointExperimental
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Get-MachineIdentitiesV1"
Write-Host $_.ErrorDetails
}
[Back to top]
list-machine-identities-v2
This API returns a list of machine identities.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Query | Filters | String | (optional) | Filter results using the standard syntax described in V3 API Standard Collection Parameters Filtering is supported for the following fields and operators: id: eq, in, sw displayName: eq, in, sw nativeIdentity: eq, in, sw attributes: eq manuallyEdited: eq subtype: eq, in owners.primaryIdentity.id: eq, in, sw owners.primaryIdentity.name: eq, in, isnull, pr owners.secondaryIdentity.id: eq, in, sw owners.secondaryIdentity.name: eq, in, isnull, pr owners.secondaryGovernanceGroup.id: eq, in owners.secondaryGovernanceGroup.name: eq, in, isnull, pr source.id: eq, in source.name: eq, in, sw entitlement.id: eq, in entitlement.name: eq, in, sw risk.severity: eq, in businessApplicationRefs.id: eq effectiveSanctionedStatus: eq Business Application filters require Business Applications to be enabled for the tenant. Filter values are case-sensitive. When Business Applications is not enabled, these filters are not allowed and return 400. |
| Query | Sorters | String | (optional) | Sort results using the standard syntax described in V3 API Standard Collection Parameters Sorting is supported for the following fields: nativeIdentity, name, owners.primaryIdentity.name, source.name, created, modified |
| Query | Count | Boolean | (optional) (default to $false) | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. |
| Query | Limit | Int32 | (optional) (default to 250) | Max number of results to return. See V3 API Standard Collection Parameters for more information. |
| Query | Offset | Int32 | (optional) (default to 0) | Offset into the full result set. Usually specified with limit to paginate through the results. See V3 API Standard Collection Parameters for more information. |
Return type
Machineidentityv2[]
Responses
| Code | Description | Data Type |
|---|
| 200 | List of machine identities. | Machineidentityv2[] |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$Filters = 'identityId eq "2c9180858082150f0180893dbaf44201"'
$Sorters = "nativeIdentity"
$Count = $true
$Limit = 250
$Offset = 0
try {
Get-MachineIdentitiesV2
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Get-MachineIdentitiesV2"
Write-Host $_.ErrorDetails
}
[Back to top]
list-machine-identity-user-entitlements-v1
This API is currently in an experimental state. The API is subject to change based on feedback and further testing. You must include the X-SailPoint-Experimental header and set it to true to use this endpoint.
This API returns a list of user entitlements associated with machine identities.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| XSailPointExperimental | String | True (default to "true") | Use this header to enable this experimental API. | |
| Query | Filters | String | (optional) | Filter results using the standard syntax described in V3 API Standard Collection Parameters Filtering is supported for the following fields and operators: machineIdentityId: eq, in machineIdentityName: eq, in, sw entitlement.id: eq, in entitlement.name: eq, in, sw source.id: eq, in source.name: eq, in, sw |
| Query | Sorters | String | (optional) | Sort results using the standard syntax described in V3 API Standard Collection Parameters Sorting is supported for the following fields: machineIdentityName, entitlement.name, source.name |
| Query | Count | Boolean | (optional) (default to $false) | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. |
| Query | Limit | Int32 | (optional) (default to 250) | Max number of results to return. See V3 API Standard Collection Parameters for more information. |
| Query | Offset | Int32 | (optional) (default to 0) | Offset into the full result set. Usually specified with limit to paginate through the results. See V3 API Standard Collection Parameters for more information. |
Return type
MachineIdentityUserEntitlementResponse[]
Responses
| Code | Description | Data Type |
|---|
| 200 | List of machine identity user entitlements. | MachineIdentityUserEntitlementResponse[] |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$XSailPointExperimental = "true"
$Filters = 'machineIdentityId eq "2c9180858082150f0180893dbaf44201"'
$Sorters = "machineIdentityName"
$Count = $true
$Limit = 250
$Offset = 0
try {
Get-MachineIdentityUserEntitlementsV1 -XSailPointExperimental $XSailPointExperimental
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Get-MachineIdentityUserEntitlementsV1"
Write-Host $_.ErrorDetails
}
[Back to top]
list-ownership-correlation-configs-v1
Returns the OWNER_PRIMARY and OWNER_SECONDARY correlation configs for the specified source resource, creating default rows if they are missing. Use the optional type query parameter to return a single matching config.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | SourceId | String | True | The Source ID. |
| Path | ResourceId | String | True | The source resource ID (for example, account or aws:iam-role). |
| Query | Type | String | (optional) | When set, filters to the given config type. |
| Query | Count | Boolean | (optional) (default to $false) | If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored. Since requesting a total count can have a performance impact, it is recommended not to send count=true if that value will not be used. See V3 API Standard Collection Parameters for more information. |
| Query | Limit | Int32 | (optional) (default to 250) | Max number of results to return. See V3 API Standard Collection Parameters for more information. |
| Query | Offset | Int32 | (optional) (default to 0) | Offset into the full result set. Usually specified with limit to paginate through the results. See V3 API Standard Collection Parameters for more information. |
Return type
CorrelationConfig[]
Responses
| Code | Description | Data Type |
|---|
| 200 | List of correlation configs. | CorrelationConfig[] |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: Not defined
- Accept: application/json
Example
$SourceId = "2c9180835d191a86015d28455b4a2329"
$ResourceId = "aws:iam-role"
$Type = "OWNER_PRIMARY"
$Count = $true
$Limit = 250
$Offset = 0
try {
Get-OwnershipCorrelationConfigsV1 -SourceId $SourceId -ResourceId $ResourceId
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Get-OwnershipCorrelationConfigsV1"
Write-Host $_.ErrorDetails
}
[Back to top]
patch-ownership-correlation-config-v1
Selectively updates an ownership correlation config using an RFC 6902 JSONPatch payload. Only replace on /attributes (full object) and replace on /rules (full array; merge by stable rule id, remove rules omitted from the array) are allowed.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | SourceId | String | True | The Source ID. |
| Path | ResourceId | String | True | The source resource ID (for example, account or aws:iam-role). |
| Path | ConfigId | String | True | The correlation config ID. |
| Body | JsonPatchOperation | []JsonPatchOperation | True | The JSONPatch payload used to update the correlation config. |
Return type
CorrelationConfig
Responses
| Code | Description | Data Type |
|---|
| 200 | The updated correlation config. | CorrelationConfig |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: application/json-patch+json
- Accept: application/json
Example
$SourceId = "2c9180835d191a86015d28455b4a2329"
$ResourceId = "aws:iam-role"
$ConfigId = "f5dd23fe-3414-42b7-bb1c-869400ad7a10"
$JsonPatchOperation = @"{
"op" : "replace",
"path" : "/description",
"value" : "New description"
}"@
try {
$Result = ConvertFrom-JsonToJsonPatchOperation -Json $JsonPatchOperation
Update-OwnershipCorrelationConfigV1 -SourceId $SourceId -ResourceId $ResourceId -ConfigId $ConfigId -JsonPatchOperation $Result
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Update-OwnershipCorrelationConfigV1"
Write-Host $_.ErrorDetails
}
[Back to top]
start-machine-identity-aggregation-v1
This API is currently in an experimental state. The API is subject to change based on feedback and further testing. You must include the X-SailPoint-Experimental header and set it to true to use this endpoint.
Starts a machine identity (AI Agents) aggregation on the specified source.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | SourceId | String | True | Source ID. |
| XSailPointExperimental | String | True (default to "true") | Use this header to enable this experimental API. | |
| Body | MachineIdentityAggregationRequest | MachineIdentityAggregationRequest | True | |
Return type
MachineIdentityAggregationResponse
Responses
| Code | Description | Data Type |
|---|
| 200 | Machine Identity Aggregation was started successfully. | MachineIdentityAggregationResponse |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: application/json
- Accept: application/json
Example
$SourceId = "ef38f94347e94562b5bb8424a56397d8"
$XSailPointExperimental = "true"
$MachineIdentityAggregationRequest = @"{
"datasetIds" : [ "source:datasetId12345", "source:datasetId12345" ],
"disableOptimization" : false
}"@
try {
$Result = ConvertFrom-JsonToMachineIdentityAggregationRequest -Json $MachineIdentityAggregationRequest
Start-MachineIdentityAggregationV1 -SourceId $SourceId -XSailPointExperimental $XSailPointExperimental -MachineIdentityAggregationRequest $Result
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Start-MachineIdentityAggregationV1"
Write-Host $_.ErrorDetails
}
[Back to top]
update-machine-identity-v1
This API is currently in an experimental state. The API is subject to change based on feedback and further testing. You must include the X-SailPoint-Experimental header and set it to true to use this endpoint.
Use this API to update machine identity details.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | Id | String | True | Machine Identity ID. |
| XSailPointExperimental | String | True (default to "true") | Use this header to enable this experimental API. | |
| Body | RequestBody | []SystemCollectionsHashtable | True | A JSON of updated values JSON Patch standard. |
Return type
MachineIdentityResponse
Responses
| Code | Description | Data Type |
|---|
| 200 | Updated Machine Identity object. | MachineIdentityResponse |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: application/json-patch+json
- Accept: application/json
Example
$Id = "ef38f94347e94562b5bb8424a56397d8"
$XSailPointExperimental = "true"
$RequestBody =
$RequestBody = @"[{"op":"add","path":"/attributes/securityRisk","value":"medium"}]"@
try {
$Result = ConvertFrom-JsonToRequestBody -Json $RequestBody
Update-MachineIdentityV1 -Id $Id -XSailPointExperimental $XSailPointExperimental -RequestBody $Result
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Update-MachineIdentityV1"
Write-Host $_.ErrorDetails
}
[Back to top]
update-machine-identity-v2
Use this API to selectively update machine identity details using a JSONPatch payload.
Patchable fields include name, description, nativeIdentity, subtype, environment, attributes, owners, userEntitlements, manuallyEdited, and businessApplicationRefs (when Business Applications is enabled for the tenant).
When Business Applications is enabled for the tenant, /businessApplicationRefs may be replaced with at most one MANUAL Business Application
reference, or cleared with an empty array. Patching /businessApplicationRefs when Business Applications is not enabled returns 400.
Existing AUTOMATIC correlations cannot be overridden (400 / ILLEGAL_UPDATE_ATTEMPT). Unknown BA id returns 404.
API Spec
Parameters
| Param Type | Name | Data Type | Required | Description |
|---|
| Path | Id | String | True | Machine Identity ID. |
| Body | JsonPatchOperation | []JsonPatchOperation | True | A JSON of updated values JSON Patch standard. |
Return type
Machineidentityv2
Responses
| Code | Description | Data Type |
|---|
| 200 | Updated machine identity object. | Machineidentityv2 |
| 400 | Client Error - Returned if the request body is invalid. | ErrorResponseDto |
| 401 | Unauthorized - Returned if there is no authorization header, or if the JWT token is expired. | ListMachineIdentitiesV1401Response |
| 403 | Forbidden - Returned if the user you are running as, doesn't have access to this end-point. | ErrorResponseDto |
| 404 | Not Found - returned if the request URL refers to a resource or object that does not exist | ErrorResponseDto |
| 429 | Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again. | ListMachineIdentitiesV1429Response |
| 500 | Internal Server Error - Returned if there is an unexpected error. | ErrorResponseDto |
- Content-Type: application/json-patch+json
- Accept: application/json
Example
$Id = "ef38f94347e94562b5bb8424a56397d8"
$JsonPatchOperation = @"{
"op" : "replace",
"path" : "/description",
"value" : "New description"
}"@
try {
$Result = ConvertFrom-JsonToJsonPatchOperation -Json $JsonPatchOperation
Update-MachineIdentityV2 -Id $Id -JsonPatchOperation $Result
} catch {
Write-Host $_.Exception.Response.StatusCode.value__ "Exception occurred when calling Update-MachineIdentityV2"
Write-Host $_.ErrorDetails
}
[Back to top]