openapi: 3.0.1
info:
  title: SailPoint SaaS API
  version: 2.0.0
servers:
  - url: https://{tenant}.api.identitynow.com/v2
    description: This is the production API server.
    variables:
      tenant:
        default: sailpoint
        description:
          This is the name of your tenant, typically your company's name.
components:
  securitySchemes:
    oauth2:
      type: oauth2
      description: |
        OAuth2 Bearer token (JWT). See [IdentityNow REST API Authentication](https://developer.sailpoint.com/idn/api/authentication) for more information.
        - Directions for generating a [personal access token](https://developer.sailpoint.com/idn/api/authentication#personal-access-tokens)
        - Directions using [client credentials flow](https://developer.sailpoint.com/idn/api/authentication#client-credentials-grant-flow)
        - Directions for using [authorization code flow](https://developer.sailpoint.com/idn/api/authentication#authorization-code-grant-flow)
        Which authentication method should I choose?  See our [guide](https://developer.sailpoint.com/idn/api/authentication#which-oauth-20-grant-flow-should-i-use)
        Learn more about how to find your `tokenUrl` and `authorizationUrl` [in our docs](https://developer.sailpoint.com/idn/api/authentication#find-your-tenants-oauth-details)
      flows:
        clientCredentials:
          tokenUrl: https://tenant.api.identitynow.com/oauth/token
          scopes:
            "sp:scopes:default": "default scope"
            "sp:scopes:all": "access to all scopes"
        authorizationCode:
          authorizationUrl: https://tenant.identitynow.com/oauth/authorize
          tokenUrl: https://tenant.api.identitynow.com/oauth/token
          scopes:
            "sp:scopes:default": "default scope"
            "sp:scopes:all": "access to all scopes"
tags:
  - name: org

paths:
 '/org':
    get:
      tags:
        - org
      summary: Retrieves your org settings.
      description: Retrieves information and operational settings for your org (as determined
        by the URL domain).
      operationId: getOrgSettings
      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type: string
                  dateCreated:
                    type: string
                    format: date-time
                  lastUpdated:
                    type: string
                    format: date-time
                  scriptName:
                    type: string
                  ssoDomain:
                    type: string
                  status:
                    type: string
                    enum:
                      - inactive
                      - active
                      - demo
                      - test
                  maxRegisteredIdentities:
                    type: integer
                  identityCount:
                    type: integer
                  kbaReqForAuthn:
                    type: integer
                  kbaReqAnswers:
                    type: integer
                  lockoutAttemptThreshold:
                    type: integer
                  lockoutTimeMinutes:
                    type: integer
                  usageCertRequired:
                    type: boolean
                  adminStrongAuthRequired:
                    type: boolean
                  enableExternalPasswordChange:
                    type: boolean
                  enablePasswordReplay:
                    type: boolean
                  enableAutomaticPasswordReplay:
                    type: boolean
                  netmasks:
                    type: array
                    items:
                      type: string
                  countryCodes:
                    type: array
                    items:
                      type: string
                  whiteList:
                    type: boolean
                  emailTestMode:
                    type: boolean
                  emailTestAddress:
                    type: string
                    format: email
                  usernameEmptyText:
                    type: string
                  usernameLabel:
                    type: string
                  enableAutomationGeneration:
                    type: boolean
                  passwordReplayState:
                    type: string
                    enum:
                      - enabled
                      - passive
                      - disabled
                  systemNotificationConfig:
                    type: object
                    properties:
                      notifications:
                        type: array
                        items:
                          type: object
                          properties:
                            type:
                              type: string
                            byEmail:
                              type: boolean
                            thresholds:
                              type: object
                              properties:
                                healthy:
                                  type: string
                                unhealthy:
                                  type: string
                      recipientType:
                        type: string
                        enum:
                          - allAdmins
                          - specificIdentities
                  systemNotificationEmails:
                    type: array
                    items:
                      type: string
                      format: email
                  loginUrl:
                    type: string
                  redirectPatterns:
                    type: array
                    items:
                      type: string
                  styleHash:
                    type: string
                  approvalConfig:
                    type: object
                    properties:
                      daysTillEscalation:
                        type: integer
                      daysBetweenReminders:
                        type: integer
                      maxReminders:
                        type: integer
                      fallbackApprover:
                        type: string
                    required:
                      - daysTillEscalation
                      - daysBetweenReminders
                      - maxReminders
                      - fallbackApprover
                  ssoPartnerSource:
                    type: string
          headers:
            ETag:
              description: Entity tag.
              schema:
                type: string
            Last-Modified:
              description: Last modified date.
              schema:
                type: string
                format: date-time
            Link:
              description: Links to alternate or related resources.
              schema:
                type: string
    patch:
      tags:
        - org
      summary: Updates one or more org attributes.
      description: Updates one or more attributes for your org.
      operationId: updateOrgSettings
      requestBody:
        description: Org settings to update.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                countryCodes:
                  type: array
                  items:
                    type: string
                enableExternalPasswordChange:
                  type: boolean
                enableAutomaticPasswordReplay:
                  type: boolean
                enableAutomationGeneration:
                  type: boolean
                kbaReqAnswers:
                  type: integer
                  format: int32
                kbaReqForAuthn:
                  type: integer
                  format: int32
                lockoutAttemptThreshold:
                  type: integer
                  format: int32
                lockoutTimeMinutes:
                  type: integer
                  format: int32
                loginUrl:
                  type: string
                netmasks:
                  type: array
                  items:
                    type: string
                notifyAuthenticationSettingChange:
                  type: boolean
                passwordReplayState:
                  type: string
                  enum:
                    - enabled
                    - passive
                    - disabled
                preferredIdentityInviteTemplate:
                  type: string
                redirectPatterns:
                  type: array
                  items:
                    type: string
                ssoPartnerSource:
                  type: string
                systemNotificationEmails:
                  type: array
                  items:
                    type: string
                    format: email
                trackAnalytics:
                  type: boolean
                usageCertRequired:
                  type: boolean
                usageCertText:
                  type: string
                usernameEmptyText:
                  type: string
                usernameLabel:
                  type: string
                whiteList:
                  type: boolean
                approvalConfig:
                  type: object
                  properties:
                    daysTillEscalation:
                      type: integer
                    daysBetweenReminders:
                      type: integer
                    maxReminders:
                      type: integer
                    fallbackApprover:
                      type: string
                  required:
                    - daysTillEscalation
                    - daysBetweenReminders
                    - maxReminders
                    - fallbackApprover

      responses:
        '200':
          description: OK.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  name:
                    type: string
                  description:
                    type: string
                  dateCreated:
                    type: string
                    format: date-time
                  lastUpdated:
                    type: string
                    format: date-time
                  scriptName:
                    type: string
                  ssoDomain:
                    type: string
                  status:
                    type: string
                    enum:
                      - inactive
                      - active
                      - demo
                      - test
                  maxRegisteredIdentities:
                    type: integer
                  identityCount:
                    type: integer
                  kbaReqForAuthn:
                    type: integer
                  kbaReqAnswers:
                    type: integer
                  lockoutAttemptThreshold:
                    type: integer
                  lockoutTimeMinutes:
                    type: integer
                  usageCertRequired:
                    type: boolean
                  adminStrongAuthRequired:
                    type: boolean
                  enableExternalPasswordChange:
                    type: boolean
                  enablePasswordReplay:
                    type: boolean
                  enableAutomaticPasswordReplay:
                    type: boolean
                  netmasks:
                    type: array
                    items:
                      type: string
                  countryCodes:
                    type: array
                    items:
                      type: string
                  whiteList:
                    type: boolean
                  emailTestMode:
                    type: boolean
                  emailTestAddress:
                    type: string
                    format: email
                  usernameEmptyText:
                    type: string
                  usernameLabel:
                    type: string
                  enableAutomationGeneration:
                    type: boolean
                  passwordReplayState:
                    type: string
                    enum:
                      - enabled
                      - passive
                      - disabled
                  systemNotificationConfig:
                    type: object
                    properties:
                      notifications:
                        type: array
                        items:
                          type: object
                          properties:
                            type:
                              type: string
                            byEmail:
                              type: boolean
                            thresholds:
                              type: object
                              properties:
                                healthy:
                                  type: string
                                unhealthy:
                                  type: string
                      recipientType:
                        type: string
                        enum:
                          - allAdmins
                          - specificIdentities
                  systemNotificationEmails:
                    type: array
                    items:
                      type: string
                      format: email
                  loginUrl:
                    type: string
                  redirectPatterns:
                    type: array
                    items:
                      type: string
                  styleHash:
                    type: string
                  approvalConfig:
                    type: object
                    properties:
                      daysTillEscalation:
                        type: integer
                      daysBetweenReminders:
                        type: integer
                      maxReminders:
                        type: integer
                      fallbackApprover:
                        type: string
                    required:
                      - daysTillEscalation
                      - daysBetweenReminders
                      - maxReminders
                      - fallbackApprover
                  ssoPartnerSource:
                    type: string
          headers:
            ETag:
              description: Entity tag.
              schema:
                type: string
            Last-Modified:
              description: Last modified date.
              schema:
                type: string
                format: date-time
            Link:
              description: Links to alternate or related resources.
              schema:
                type: string
 '/workgroups':
    get:
      operationId: listWorkgroups
      tags:
        - Governance Groups
      summary: List Work Groups
      description: This API returns a list of work groups
      security:
        - oauth2: []
      parameters:
        - in: query
          name: limit
          description: >-
            Max number of results to return
          required: false
          example: 250
          schema:
            type: integer
            format: int32
            minimum: 0
            maximum: 250
            default: 250
        - in: query
          name: offset
          description: >-
            Offset into the full result set. Usually specified with *limit* to paginate through the results.
          required: false
          example: 0
          schema:
            type: integer
            format: int32
            minimum: 0
            default: 0
        - in: query
          name: filters
          schema:
            type: string
          description: >-
            Filter results using the following syntax.

            [{property:name, value: "Tyler", operation: EQ}]
          required: false
      responses:
        '200':
          description: List of work group objects
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    connectionCount:
                      type: integer
                      format: int32
                      example: 2
                    created:
                      type: integer
                      format: int64
                      example: 1641498673000
                    description:
                      type: string
                      example: Phil Governance Group
                    id:
                      type: string
                      example: b0c131fa-5133-4efb-9bb2-e22529f44cad
                    memberCount:
                      type: integer
                      format: int32
                      example: 2
                    modified:
                      type: integer
                      format: int64
                      example: 1641498673000
                    name:
                      type: string
                      example: Phil Governance Group
                    owner:
                      type: object
                      properties:
                        displayName:
                          type: string
                          example: Philip Ellis
                        emailAddress:
                          type: string
                          example: philip.ellis@sailpoint.com
                        id:
                          type: string
                          example: 2c9180897d2cb80b017d39ccb26c1804
                        name:
                          type: string
                          example: philip.ellis

    post:
      operationId: createWorkgroup
      tags:
          - Governance Groups
      summary: Create Work Group
      description: This API allows you to create a work group
      security:
          - oauth2: []
      requestBody:
        description: Work group to create.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name: 
                  type: string
                  example: Test group 3
                description: 
                  type: string
                  example: This is a test
                owner: 
                  type: object
                  properties: 
                    id: 
                      type: string
                      example: 2c9180867624cbd7017642d8c8c81f67
      responses:
        '200':
          description: List of work group objects
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    connectionCount:
                      type: integer
                      format: int32
                      example: 2
                    created:
                      type: integer
                      format: int64
                      example: 1641498673000
                    description:
                      type: string
                      example: Phil Governance Group
                    id:
                      type: string
                      example: b0c131fa-5133-4efb-9bb2-e22529f44cad
                    memberCount:
                      type: integer
                      format: int32
                      example: 2
                    modified:
                      type: integer
                      format: int64
                      example: 1641498673000
                    name:
                      type: string
                      example: Phil Governance Group
                    owner:
                      type: object
                      properties:
                        displayName:
                          type: string
                          example: Philip Ellis
                        emailAddress:
                          type: string
                          example: philip.ellis@sailpoint.com
                        id:
                          type: string
                          example: 2c9180897d2cb80b017d39ccb26c1804
                        name:
                          type: string
                          example: philip.ellis
 '/workgroups/{workgroupId}':
    get:
      operationId: getWorkgroup
      tags:
        - Governance Groups
      summary: Get Work Group By Id
      description: This API returns the details for a single workgroup based on the ID
      security:
        - oauth2: []
      parameters:
        - in: path
          name: workgroupId
          schema:
            type: string
          required: true
          description: The workgroup ID
          example: ef38f94347e94562b5bb8424a56397d8
      responses:
        '200':
          description: Workgroup object
          content:
            application/json:
              schema:
                type: object
                properties:
                  connectionCount:
                    type: integer
                    format: int32
                    example: 2
                  created:
                    type: integer
                    format: int64
                    example: 1641498673000
                  description:
                    type: string
                    example: Phil Governance Group
                  id:
                    type: string
                    example: b0c131fa-5133-4efb-9bb2-e22529f44cad
                  memberCount:
                    type: integer
                    format: int32
                    example: 2
                  modified:
                    type: integer
                    format: int64
                    example: 1641498673000
                  name:
                    type: string
                    example: Phil Governance Group
                  owner:
                    type: object
                    properties:
                      displayName:
                        type: string
                        example: Philip Ellis
                      emailAddress:
                        type: string
                        example: philip.ellis@sailpoint.com
                      id:
                        type: string
                        example: 2c9180897d2cb80b017d39ccb26c1804
                      name:
                        type: string
                        example: philip.ellis
    patch:
      operationId: updateWorkgroup
      tags:
        - Governance Groups
      summary: Update Work Group By Id
      description: This API updates and returns the details for a single workgroup based on the ID
      security:
        - oauth2: []
      parameters:
        - in: path
          name: workgroupId
          schema:
            type: string
          required: true
          description: The workgroup ID
          example: ef38f94347e94562b5bb8424a56397d8
      requestBody:
        description: Work group to modify.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name: 
                  type: string
                  example: Test group 3
                description: 
                  type: string
                  example: This is a test
                owner: 
                  type: object
                  properties: 
                    id: 
                      type: string
                      example: 2c9180867624cbd7017642d8c8c81f67
      responses:
        '200':
          description: Workgroup object
          content:
            application/json:
              schema:
                type: object
                properties:
                  connectionCount:
                    type: integer
                    format: int32
                    example: 2
                  created:
                    type: integer
                    format: int64
                    example: 1641498673000
                  description:
                    type: string
                    example: Phil Governance Group
                  id:
                    type: string
                    example: b0c131fa-5133-4efb-9bb2-e22529f44cad
                  memberCount:
                    type: integer
                    format: int32
                    example: 2
                  modified:
                    type: integer
                    format: int64
                    example: 1641498673000
                  name:
                    type: string
                    example: Phil Governance Group
                  owner:
                    type: object
                    properties:
                      displayName:
                        type: string
                        example: Philip Ellis
                      emailAddress:
                        type: string
                        example: philip.ellis@sailpoint.com
                      id:
                        type: string
                        example: 2c9180897d2cb80b017d39ccb26c1804
                      name:
                        type: string
                        example: philip.ellis

    delete:
      operationId: deleteWorkgroup
      tags:
        - Governance Groups
      summary: Delete Work Group By Id
      description: This API deletes a single workgroup based on the ID
      security:
        - oauth2: []
      parameters:
        - in: path
          name: workgroupId
          schema:
            type: string
          required: true
          description: The workgroup ID
          example: ef38f94347e94562b5bb8424a56397d8
      responses:
        '204':
          description: Empty response on successful deletion
          content:
            application/json: {}
 '/workgroups/{workgroupId}/members':
    get:
      operationId: listWorkgroupMembers
      tags:
        - Governance Groups
      summary: List Work Group Members
      description: This API returns the members of a work group
      security:
        - oauth2: []
      parameters:
        - in: path
          name: workgroupId
          schema:
            type: string
          required: true
          description: The workgroup ID
          example: ef38f94347e94562b5bb8424a56397d8
        - in: query
          name: limit
          description: >-
            Max number of results to return
          required: false
          example: 250
          schema:
            type: integer
            format: int32
            minimum: 0
            maximum: 250
            default: 250
        - in: query
          name: offset
          description: >-
            Offset into the full result set. Usually specified with *limit* to paginate through the results.
          required: false
          example: 0
          schema:
            type: integer
            format: int32
            minimum: 0
            default: 0
        - in: query
          name: filters
          schema:
            type: string
          description: >-
            Filter results using the following syntax.

            [{property:name, value: "Tyler", operation: EQ}]
      responses:
        '200':
          description: List of work group member objects
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    alias: 
                      type: string
                      example: Jerry.Bennett
                    email: 
                      type: string
                      example: Jerry.Bennett@sailpointdemo.com
                    externalId: 
                      type: string
                      example: 2c9180837dfe6949017e208e26027b23
                    id: 
                      type: integer
                      format: int32
                      example: 3497959
                    name: 
                      type: string
                      example: Jerry.Bennett
    post:
      operationId: modifyWorkgroupMembers
      tags:
          - Governance Groups
      summary: Modify Work Group Members
      description: This API allows you to modify the members of a work group
      security:
          - oauth2: []
      parameters:
        - in: path
          name: workgroupId
          schema:
            type: string
          required: true
          description: The workgroup ID
          example: ef38f94347e94562b5bb8424a56397d8
      requestBody:
        description: Add/Remove workgroup member ids.
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                  add: 
                    type: array
                    items: 
                      type: string
                      example: 2c9180867624cbd7017642d8c8c81f67
                  remove: 
                    type: array
                    items: 
                      type: string
                      example: 2c9180867624cbd7017642d8c8c81f67
      responses:
        '204':
          description: Empty response on successful deletion
          content:
            application/json: {}
 '/workgroups/{workgroupId}/connections':
    get:
      operationId: listWorkgroupConnections
      tags:
        - Governance Groups
      summary: List Work Group Connections
      description: This API returns the connections of a work group
      security:
        - oauth2: []
      parameters:
        - in: path
          name: workgroupId
          schema:
            type: string
          required: true
          description: The workgroup ID
          example: ef38f94347e94562b5bb8424a56397d8
      responses:
        '200':
          description: List of work group connection objects
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    connectionType: 
                      type: string
                      example: AccessRequestReviewer
                    description: 
                      type: string
                      format: nullable
                    name: 
                      type: string
                      example: Test Approval Scheme
                    objectId: 
                      type: string
                      example: 8c24b31fe23947b28e42691a4a6faaee
                    objectType: 
                      type: string
                      example: AccessProfile
                    workgroupId: 
                      type: string
                      example: b0c131fa-5133-4efb-9bb2-e22529f44cad
 '/workgroups/bulk-delete':
    post:
      operationId: bulkDeleteWorkGroups
      tags:
          - Governance Groups
      summary: Bulk delete work groups
      description: This API allows you to bulk-delete work groups
      security:
          - oauth2: []
      requestBody:
        description: Work group ids to delete
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                  ids: 
                    type: array
                    items: 
                      type: string
                      example: 868edef1-222b-40e4-8787-b56cfd78b100
      responses:
        '200':
          description: List of work group objects
          content:
            application/json:
              schema:
                type: object
                properties:
                  deleted: 
                    type: array
                    items: 
                      type: string
                      example: 4518f275-e7de-40b8-9951-b67d6273421c
                  inUse: 
                    type: array
                    items: 
                      type: string
                      example: 12538dlg-60d0-44b4-9273-d1ba578ef384
                  notFound: 
                    type: array
                    items: 
                      type: string
                      example: 12538ecf-60d0-44b4-9273-d1ba578ef384