---
id: check-policy-violations
sidebar_label: This endpoint simulates provisioning a set of access items, and then checks against a set of policies to determine if granting the access items would cause creation of new policy violations.
hide_title: true
hide_table_of_contents: true
api: {"operationId":"checkPolicyViolations","tags":["Checked Policy Violations"],"description":">This submits a set of access items to request and a set of policies to check after the access provisioning is simulated in order to determine if policy violations would be created by provisioning the access items. It receives a payload that includes:  \n\n>**An identity:** Used as the recipient for the access items on the simulation. \n\n>**A provisioning plan:** To specify the changes to be simulatedly provisioned in the provided identity  \n\n>**A list of policies:** to check after the simulation of provisioning plan was applied to the identity in order to determine if the access granted in the simulation causes new policy violations. \n\n>Optionally you can pass a list of attributes, as query params, to be included or excluded from the response, this setting is applicable only to top level attributes as defined in the schema ***urn:ietf:params:scim:schemas:sailpoint:1.0:CheckedPolicyViolation.***  \n\n>**Valid values**: \n**- policies**\n **- identity**\n **- plan**\n **- violations**\n **- leftBundles**\n **- rightBundles** \n","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"identity":{"description":"An identity for whom access is requested on the provisioning simulation","type":"string","example":{"identity":"Ryan.Russell"}},"plan":{"description":"A provisioning plan detailing the access to request on the simulation","type":"object","properties":{"value":{"type":"object","properties":{"accounts":{"type":"array","items":{"type":"object","properties":{"op":{"description":"The operation to perform on the provisioning.","type":"string","example":"Modify"},"instance":{"type":"string","example":"null","description":"A particular instance to provision this access to"},"application":{"type":"string","example":"Active_Directory","description":"The application that owns the access items in the request"},"attributes":{"type":"array","items":{"type":"object","properties":{"op":{"description":"The operation to perform on the access item.","type":"string","example":"Add"},"name":{"description":"The type of access item to provision.","type":"string","example":"groupmbr"},"value":{"description":"The name of the access item to provision.","type":"string","example":"UnixAdministration"}}}}}}}}}}},"type":{"type":"string","example":"application/sailpoint.object.ProvisioningPlan+json"},"policies":{"description":"A list of policies to check for new policy violations on the access provisioned by the simulation.","type":"array","items":{"type":"string"},"example":["SOD Policy","Entitlement Policy","RandomPolicyNotExisting"]}}}}}},"responses":{"201":{"description":"Returns a list of violations based on simulated requested access","content":{"application/json":{"schema":{"type":"object","properties":{"identity":{"description":"An identity for whom access was requested on the provisioning simulation","type":"string","example":{"identity":"Ryan.Russell"}},"meta":{"type":"object","properties":{"resourceType":{"description":"","type":"string","example":"CheckedPolicyViolation"}}},"violations":{"type":"array","items":{"properties":{"entitlements":{"description":"An array of the entitlements used in the provisioning simulation.","type":"array","items":{"type":"string"},"example":["a2a","a2b","benefits"]},"policyName":{"description":"The name of the policy that conflicted with the access items provisioned in the simulation causing policy violation.","type":"string","example":"SOD Policy"},"policyType":{"description":"The type of the policy that conflicted with the access items provisioned in the simulation causing policy violation(s).","type":"string","example":"SOD"},"description":{"description":"The description of the policy violation(s) caused by the access provisioned in the simulation.","type":"string","example":"Security design should not be combined with administrative permissions."},"constraintName":{"description":"The specific constraint in the policy that conflicted with the access items provisioned in the simulation.","type":"string","example":" IT SOD-117"},"leftBundles":{"description":"The left set of entitlements defined in the policy constraint in order to check against another set of entitlements for compliance.","type":"array","items":{"type":"string"},"example":["Security Architect - IT"]},"rightBundles":{"description":"The right set of entitlements defined in the policy constraint in order to check against another set of entitlements for compliance.","type":"array","items":{"type":"string"},"example":["Unix Administrator - IT"]}}}},"schemas":{"description":"The SCIM schema for Checked Policy Violations.","type":"array","items":{"type":"string","example":"urn:ietf:params:scim:schemas:sailpoint:1.0:CheckedPolicyViolation"}},"policies":{"description":"The set of policies used to check for conflicting access in the provisioning simulation","type":"array","items":{"type":"string"},"example":["SOD Policy","Entitlement Policy","RandomPolicyNotExisting"]},"plan":{"description":"A provisioning plan detailing the access to request on the simulation","type":"object","properties":{"value":{"type":"object","properties":{"accounts":{"type":"array","items":{"type":"object","properties":{"op":{"description":"The operation performed on the access in the provisioning simulation.","type":"string","example":"Modify"},"instance":{"type":"string","example":"null","description":"A particular instance to provision this access to"},"application":{"type":"string","example":"Active_Directory","description":"The application that owns the access provisioned in the simulation."},"attributes":{"type":"array","items":{"type":"object","properties":{"op":{"description":"The operation performed on the access in the provisioning simulation.","type":"string","example":"Add"},"name":{"description":"The type of provisioned access.","type":"string","example":"groupmbr"},"value":{"description":"The name of the provisioned access items.","type":"string","example":"UnixAdministration"}}}}}}}}},"type":{"type":"string","example":"application/sailpoint.object.ProvisioningPlan+json"}}}}}}}}},"parameters":[{"in":"query","name":"attributes","schema":{"type":"string"},"description":"A list of attributes to indicate what top level attributes to include in the response"},{"in":"query","name":"authnPassword","schema":{"type":"string"},"description":"Password for authentication"},{"in":"query","name":"authnUsername","schema":{"type":"string"},"description":"Username for authentication"},{"in":"query","name":"excludedAttributes","schema":{"type":"string"},"description":"A list of attributes to indicate what top level attributes to exclude from the response"},{"in":"query","name":"lookupByName","schema":{"type":"boolean"},"description":"This is not required in this endpoint, the returned object is a new PolicyViolation and not one returned from the persistence layer. This is inherited from the BaseSCIMResource and is used to override the default id based lookup, and use a name based lookup instead, if for any reason the artifact id is not present.","example":false}],"method":"post","path":"/CheckedPolicyViolations","servers":[{"url":"http://localhost:8080/identityiq/scim/v2","description":"IdentityIQ SCIM server basepath and path to API."}],"security":[{"basicAuth":[]}],"securitySchemes":{"basicAuth":{"type":"http","scheme":"basic"}},"jsonRequestBodyExample":{"identity":{"identity":"Ryan.Russell"},"plan":{"value":{"accounts":[{"op":"Modify","instance":"null","application":"Active_Directory","attributes":[{"op":"Add","name":"groupmbr","value":"UnixAdministration"}]}]}},"type":"application/sailpoint.object.ProvisioningPlan+json","policies":["SOD Policy","Entitlement Policy","RandomPolicyNotExisting"]},"info":{"description":"IdentityIQ REST Endpoint Interface Documentation for SCIM\n","version":"8.3","title":"IdentityIQ SCIM REST API"},"postman":{"name":"This endpoint simulates provisioning a set of access items, and then checks against a set of policies to determine if granting the access items would cause creation of new policy violations.","description":{"content":">This submits a set of access items to request and a set of policies to check after the access provisioning is simulated in order to determine if policy violations would be created by provisioning the access items. It receives a payload that includes:  \n\n>**An identity:** Used as the recipient for the access items on the simulation. \n\n>**A provisioning plan:** To specify the changes to be simulatedly provisioned in the provided identity  \n\n>**A list of policies:** to check after the simulation of provisioning plan was applied to the identity in order to determine if the access granted in the simulation causes new policy violations. \n\n>Optionally you can pass a list of attributes, as query params, to be included or excluded from the response, this setting is applicable only to top level attributes as defined in the schema ***urn:ietf:params:scim:schemas:sailpoint:1.0:CheckedPolicyViolation.***  \n\n>**Valid values**: \n**- policies**\n **- identity**\n **- plan**\n **- violations**\n **- leftBundles**\n **- rightBundles** \n","type":"text/plain"},"url":{"path":["CheckedPolicyViolations"],"host":["{{baseUrl}}"],"query":[{"disabled":false,"description":{"content":"A list of attributes to indicate what top level attributes to include in the response","type":"text/plain"},"key":"attributes","value":""},{"disabled":false,"description":{"content":"Password for authentication","type":"text/plain"},"key":"authnPassword","value":""},{"disabled":false,"description":{"content":"Username for authentication","type":"text/plain"},"key":"authnUsername","value":""},{"disabled":false,"description":{"content":"A list of attributes to indicate what top level attributes to exclude from the response","type":"text/plain"},"key":"excludedAttributes","value":""},{"disabled":false,"description":{"content":"This is not required in this endpoint, the returned object is a new PolicyViolation and not one returned from the persistence layer. This is inherited from the BaseSCIMResource and is used to override the default id based lookup, and use a name based lookup instead, if for any reason the artifact id is not present.","type":"text/plain"},"key":"lookupByName","value":""}],"variable":[]},"header":[{"key":"Content-Type","value":"application/json"},{"key":"Accept","value":"application/json"}],"method":"POST","body":{"mode":"raw","raw":"\"\"","options":{"raw":{"language":"json"}}}}}
sidebar_class_name: "post api-method"
info_path: iiq/api/identityiq-scim-rest-api
custom_edit_url: "https://github.com/sailpoint-oss/developer.sailpoint.com/issues/new?assignees=&labels=&template=bug-report.md&title=%5BBug%5D+Your+Bug+Report+Here Requesting changes to 'This endpoint simulates provisioning a set of access items, and then checks against a set of policies to determine if granting the access items would cause creation of new policy violations.' (check-policy-violations)"
---

import ApiTabs from "@theme/ApiTabs";
import MimeTabs from "@theme/MimeTabs";
import ParamsItem from "@theme/ParamsItem";
import ResponseSamples from "@theme/ResponseSamples";
import SchemaItem from "@theme/SchemaItem";
import SchemaTabs from "@theme/SchemaTabs";
import DiscriminatorTabs from "@theme/DiscriminatorTabs";
import TabItem from "@theme/TabItem";

## This endpoint simulates provisioning a set of access items, and then checks against a set of policies to determine if granting the access items would cause creation of new policy violations.



\>This submits a set of access items to request and a set of policies to check after the access provisioning is simulated in order to determine if policy violations would be created by provisioning the access items. It receives a payload that includes:  

>**An identity:** Used as the recipient for the access items on the simulation. 

>**A provisioning plan:** To specify the changes to be simulatedly provisioned in the provided identity  

>**A list of policies:** to check after the simulation of provisioning plan was applied to the identity in order to determine if the access granted in the simulation causes new policy violations. 

>Optionally you can pass a list of attributes, as query params, to be included or excluded from the response, this setting is applicable only to top level attributes as defined in the schema ***urn:ietf:params:scim:schemas:sailpoint:1.0:CheckedPolicyViolation.***  

>**Valid values**: 
**- policies**
 **- identity**
 **- plan**
 **- violations**
 **- leftBundles**
 **- rightBundles** 


<details style={{"marginBottom":"1rem"}} data-collapsed={false} open={true}><summary style={{}}><strong>Query Parameters</strong></summary><div><ul><ParamsItem className={"paramsItem"} param={{"in":"query","name":"attributes","schema":{"type":"string"},"description":"A list of attributes to indicate what top level attributes to include in the response"}}></ParamsItem><ParamsItem className={"paramsItem"} param={{"in":"query","name":"authnPassword","schema":{"type":"string"},"description":"Password for authentication"}}></ParamsItem><ParamsItem className={"paramsItem"} param={{"in":"query","name":"authnUsername","schema":{"type":"string"},"description":"Username for authentication"}}></ParamsItem><ParamsItem className={"paramsItem"} param={{"in":"query","name":"excludedAttributes","schema":{"type":"string"},"description":"A list of attributes to indicate what top level attributes to exclude from the response"}}></ParamsItem><ParamsItem className={"paramsItem"} param={{"in":"query","name":"lookupByName","schema":{"type":"boolean"},"description":"This is not required in this endpoint, the returned object is a new PolicyViolation and not one returned from the persistence layer. This is inherited from the BaseSCIMResource and is used to override the default id based lookup, and use a name based lookup instead, if for any reason the artifact id is not present.","example":false}}></ParamsItem></ul></div></details><MimeTabs><TabItem label={"application/json"} value={"application/json-schema"}><details style={{}} data-collapsed={false} open={true}><summary style={{"textAlign":"left"}}><strong>Request Body</strong><strong style={{"fontSize":"var(--ifm-code-font-size)","color":"var(--openapi-required)"}}> required</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"identity"} required={false} deprecated={undefined} schemaDescription={"An identity for whom access is requested on the provisioning simulation"} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>plan</strong><span style={{"opacity":"0.6"}}> object</span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

A provisioning plan detailing the access to request on the simulation

</div><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>value</strong><span style={{"opacity":"0.6"}}> object</span></summary><div style={{"marginLeft":"1rem"}}><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>accounts</strong><span style={{"opacity":"0.6"}}> object[]</span></summary><div style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"op"} required={false} deprecated={undefined} schemaDescription={"The operation to perform on the provisioning."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"instance"} required={false} deprecated={undefined} schemaDescription={"A particular instance to provision this access to"} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"application"} required={false} deprecated={undefined} schemaDescription={"The application that owns the access items in the request"} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>attributes</strong><span style={{"opacity":"0.6"}}> object[]</span></summary><div style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"op"} required={false} deprecated={undefined} schemaDescription={"The operation to perform on the access item."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={false} deprecated={undefined} schemaDescription={"The type of access item to provision."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"value"} required={false} deprecated={undefined} schemaDescription={"The name of the access item to provision."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem></div></details></SchemaItem></div></details></SchemaItem></div></details></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"type"} required={false} deprecated={undefined} schemaDescription={undefined} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"policies"} required={false} deprecated={undefined} schemaDescription={"A list of policies to check for new policy violations on the access provisioned by the simulation."} schemaName={"string[]"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem></ul></details></TabItem></MimeTabs><div><ApiTabs><TabItem label={"201"} value={"201"}><div>

Returns a list of violations based on simulated requested access

</div><div><MimeTabs schemaType={"response"}><TabItem label={"application/json"} value={"application/json"}><SchemaTabs><TabItem label={"Schema"} value={"Schema"}><details style={{}} data-collapsed={false} open={true}><summary style={{"textAlign":"left"}}><strong>Schema</strong></summary><div style={{"textAlign":"left","marginLeft":"1rem"}}></div><ul style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"identity"} required={false} deprecated={undefined} schemaDescription={"An identity for whom access was requested on the provisioning simulation"} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>meta</strong><span style={{"opacity":"0.6"}}> object</span></summary><div style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"resourceType"} required={false} deprecated={undefined} schemaDescription={""} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>violations</strong><span style={{"opacity":"0.6"}}> undefined[]</span></summary><div style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"entitlements"} required={false} deprecated={undefined} schemaDescription={"An array of the entitlements used in the provisioning simulation."} schemaName={"string[]"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"policyName"} required={false} deprecated={undefined} schemaDescription={"The name of the policy that conflicted with the access items provisioned in the simulation causing policy violation."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"policyType"} required={false} deprecated={undefined} schemaDescription={"The type of the policy that conflicted with the access items provisioned in the simulation causing policy violation(s)."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"description"} required={false} deprecated={undefined} schemaDescription={"The description of the policy violation(s) caused by the access provisioned in the simulation."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"constraintName"} required={false} deprecated={undefined} schemaDescription={"The specific constraint in the policy that conflicted with the access items provisioned in the simulation."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"leftBundles"} required={false} deprecated={undefined} schemaDescription={"The left set of entitlements defined in the policy constraint in order to check against another set of entitlements for compliance."} schemaName={"string[]"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"rightBundles"} required={false} deprecated={undefined} schemaDescription={"The right set of entitlements defined in the policy constraint in order to check against another set of entitlements for compliance."} schemaName={"string[]"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"schemas"} required={false} deprecated={undefined} schemaDescription={"The SCIM schema for Checked Policy Violations."} schemaName={"string[]"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"policies"} required={false} deprecated={undefined} schemaDescription={"The set of policies used to check for conflicting access in the provisioning simulation"} schemaName={"string[]"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>plan</strong><span style={{"opacity":"0.6"}}> object</span></summary><div style={{"marginLeft":"1rem"}}><div style={{"marginTop":".5rem","marginBottom":".5rem"}}>

A provisioning plan detailing the access to request on the simulation

</div><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>value</strong><span style={{"opacity":"0.6"}}> object</span></summary><div style={{"marginLeft":"1rem"}}><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>accounts</strong><span style={{"opacity":"0.6"}}> object[]</span></summary><div style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"op"} required={false} deprecated={undefined} schemaDescription={"The operation performed on the access in the provisioning simulation."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"instance"} required={false} deprecated={undefined} schemaDescription={"A particular instance to provision this access to"} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"application"} required={false} deprecated={undefined} schemaDescription={"The application that owns the access provisioned in the simulation."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={true} className={"schemaItem"}><details style={{}}><summary style={{}}><strong>attributes</strong><span style={{"opacity":"0.6"}}> object[]</span></summary><div style={{"marginLeft":"1rem"}}><SchemaItem collapsible={false} name={"op"} required={false} deprecated={undefined} schemaDescription={"The operation performed on the access in the provisioning simulation."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"name"} required={false} deprecated={undefined} schemaDescription={"The type of provisioned access."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem><SchemaItem collapsible={false} name={"value"} required={false} deprecated={undefined} schemaDescription={"The name of the provisioned access items."} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem></div></details></SchemaItem></div></details></SchemaItem></div></details></SchemaItem><SchemaItem collapsible={false} name={"type"} required={false} deprecated={undefined} schemaDescription={undefined} schemaName={"string"} qualifierMessage={undefined} defaultValue={undefined}></SchemaItem></div></details></SchemaItem></ul></details></TabItem><TabItem label={"Example (from schema)"} value={"Example (from schema)"}><ResponseSamples responseExample={"{\n  \"identity\": {\n    \"identity\": \"Ryan.Russell\"\n  },\n  \"meta\": {\n    \"resourceType\": \"CheckedPolicyViolation\"\n  },\n  \"violations\": [\n    {\n      \"entitlements\": [\n        \"a2a\",\n        \"a2b\",\n        \"benefits\"\n      ],\n      \"policyName\": \"SOD Policy\",\n      \"policyType\": \"SOD\",\n      \"description\": \"Security design should not be combined with administrative permissions.\",\n      \"constraintName\": \" IT SOD-117\",\n      \"leftBundles\": [\n        \"Security Architect - IT\"\n      ],\n      \"rightBundles\": [\n        \"Unix Administrator - IT\"\n      ]\n    }\n  ],\n  \"schemas\": [\n    \"urn:ietf:params:scim:schemas:sailpoint:1.0:CheckedPolicyViolation\"\n  ],\n  \"policies\": [\n    \"SOD Policy\",\n    \"Entitlement Policy\",\n    \"RandomPolicyNotExisting\"\n  ],\n  \"plan\": {\n    \"value\": {\n      \"accounts\": [\n        {\n          \"op\": \"Modify\",\n          \"instance\": \"null\",\n          \"application\": \"Active_Directory\",\n          \"attributes\": [\n            {\n              \"op\": \"Add\",\n              \"name\": \"groupmbr\",\n              \"value\": \"UnixAdministration\"\n            }\n          ]\n        }\n      ]\n    },\n    \"type\": \"application/sailpoint.object.ProvisioningPlan+json\"\n  }\n}"} language={"json"}></ResponseSamples></TabItem></SchemaTabs></TabItem></MimeTabs></div></TabItem></ApiTabs></div>