openapi: 3.0.0
info:
  title: IdentityNow cc (private) APIs
  version: 1.0.0
servers:
  - url: https://{tenant}.api.identitynow.com
    description: This is the production API server.
    variables:
      tenant:
        default: sailpoint
        description:
          This is the name of your tenant, typically your company's name.
components:
  securitySchemes:
    oauth2:
      type: oauth2
      description: |
        OAuth2 Bearer token (JWT). See [IdentityNow REST API Authentication](https://developer.sailpoint.com/idn/api/authentication) for more information.
        - Directions for generating a [personal access token](https://developer.sailpoint.com/idn/api/authentication#personal-access-tokens)
        - Directions using [client credentials flow](https://developer.sailpoint.com/idn/api/authentication#client-credentials-grant-flow)
        - Directions for using [authorization code flow](https://developer.sailpoint.com/idn/api/authentication#authorization-code-grant-flow)

        Which authentication method should I choose?  See our [guide](https://developer.sailpoint.com/idn/api/authentication#which-oauth-20-grant-flow-should-i-use)

        Learn more about how to find your `tokenUrl` and `authorizationUrl` [in our docs](https://developer.sailpoint.com/idn/api/authentication#find-your-tenants-oauth-details)
      flows:
        clientCredentials:
          tokenUrl: https://tenant.api.identitynow.com/oauth/token
          scopes:
            "sp:scopes:default": "default scope"
            "sp:scopes:all": "access to all scopes"
        authorizationCode:
          authorizationUrl: https://tenant.identitynow.com/oauth/authorize
          tokenUrl: https://tenant.api.identitynow.com/oauth/token
          scopes:
            "sp:scopes:default": "default scope"
            "sp:scopes:all": "access to all scopes"
tags:
  - name: Accounts
  - name: Applications
  - name: Connectors
  - name: User
  - name: Sources > Aggregation
  - name: Sources > Accounts
  - name: System
paths:
  /cc/api/account/list:
    get:
      tags:
        - Accounts
      summary: List Accounts
      operationId: listAccounts
      security:
        - oauth2: []
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/account/remove/{id}:
    post:
      tags:
        - Accounts
      summary: Remove Account
      operationId: removeAccount
      security:
        - oauth2: []
      parameters:
        - name: id
          in: path
          schema:
            type: string
          example: 12345
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/app/list:
    get:
      tags:
        - Applications
      summary: List Applications
      operationId: listApplications
      security:
        - oauth2: []
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                    appId:
                      type: string
                    serviceId:
                      type: string
                    serviceAppId:
                      type: string
                    name:
                      type: string
                    description:
                      type: string
                    appCenterEnabled:
                      type: boolean
                    provisionRequestEnabled:
                      type: boolean
                    controlType:
                      type: string
                    mobile:
                      type: boolean
                    privateApp:
                      type: boolean
                    scriptName:
                      type: string
                    status:
                      type: string
                    icon:
                      type: string
                    health:
                      type: object
                      properties:
                        status:
                          type: string
                        lastChanged:
                          type: string
                        since:
                          type: number
                        healthy:
                          type: boolean
                    enableSso:
                      type: boolean
                    ssoMethod:
                      type: string
                    hasLinks:
                      type: boolean
                    hasAutomations:
                      type: boolean
                    stepUpAuthData:
                      type: object
                    stepUpAuthType:
                      type: string
                    usageAnalytics:
                      type: boolean
                    usageCertRequired:
                      type: boolean
                    usageCertText:
                      type: object
                    launchpadEnabled:
                      type: boolean
                    passwordManaged:
                      type: boolean
                    owner:
                      type: object
                      properties:
                        id:
                          type: string
                        name:
                          type: string
                    dateCreated:
                      type: number
                    lastUpdated:
                      type: number
                    defaultAccessProfile:
                      type: object
                    service:
                      type: string
                    selectedSsoMethod:
                      type: string
                    supportedSsoMethods:
                      type: number
                    offNetworkBlockedRoles:
                      type: object
                    supportedOffNetwork:
                      type: string
                    accountServiceId:
                      type: number
                    launcherCount:
                      type: number
                    accountServiceName:
                      type: string
                    accountServiceExternalId:
                      type: string
                    accountServiceMatchAllAccounts:
                      type: boolean
                    externalId:
                      type: string
                    accountServiceUseForPasswordManagement:
                      type: boolean
                    accountServicePolicyId:
                      type: string
                    accountServicePolicyName:
                      type: string
                    requireStrongAuthn:
                      type: boolean
                    accountServicePolicies:
                      type: array
                      items:
                        type: object
                        properties:
                          policyId:
                            type: string
                          policyName:
                            type: string
                          selectors:
                            type: object
                    xsdVersion:
                      type: string
                    appProfiles:
                      type: array
                      items:
                        type: object
                        properties:
                          id:
                            type: number
                          filename:
                            type: string
                          createdBy:
                            type: string
                          dateCreated:
                            type: string
                          xsdVersion:
                            type: string
                    passwordServiceId:
                      type: number
                    accessProfileIds:
                      type: object
  /cc/api/app/get/{id}:
    get:
      tags:
        - Applications
      summary: Get Single Application
      operationId: GetApplication
      security:
        - oauth2: []
      parameters:
        - name: id
          in: path
          schema:
            type: string
          example: 12345
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  appId:
                    type: string
                  serviceId:
                    type: string
                  serviceAppId:
                    type: string
                  name:
                    type: string
                  description:
                    type: string
                  appCenterEnabled:
                    type: boolean
                  provisionRequestEnabled:
                    type: boolean
                  controlType:
                    type: string
                  mobile:
                    type: boolean
                  privateApp:
                    type: boolean
                  scriptName:
                    type: string
                  status:
                    type: string
                  icon:
                    type: string
                  health:
                    type: object
                    properties:
                      status:
                        type: string
                      lastChanged:
                        type: string
                      since:
                        type: number
                      healthy:
                        type: boolean
                  enableSso:
                    type: boolean
                  ssoMethod:
                    type: string
                  hasLinks:
                    type: boolean
                  hasAutomations:
                    type: boolean
                  stepUpAuthData:
                    type: object
                  stepUpAuthType:
                    type: string
                  usageAnalytics:
                    type: boolean
                  usageCertRequired:
                    type: boolean
                  usageCertText:
                    type: object
                  launchpadEnabled:
                    type: boolean
                  passwordManaged:
                    type: boolean
                  owner:
                    type: object
                    properties:
                      id:
                        type: string
                      name:
                        type: string
                  dateCreated:
                    type: number
                  lastUpdated:
                    type: number
                  defaultAccessProfile:
                    type: object
                  service:
                    type: string
                  selectedSsoMethod:
                    type: string
                  supportedSsoMethods:
                    type: number
                  offNetworkBlockedRoles:
                    type: object
                  supportedOffNetwork:
                    type: string
                  accountServiceId:
                    type: number
                  launcherCount:
                    type: number
                  accountServiceName:
                    type: string
                  accountServiceExternalId:
                    type: string
                  accountServiceMatchAllAccounts:
                    type: boolean
                  externalId:
                    type: string
                  accountServiceUseForPasswordManagement:
                    type: boolean
                  accountServicePolicyId:
                    type: string
                  accountServicePolicyName:
                    type: string
                  requireStrongAuthn:
                    type: boolean
                  accountServicePolicies:
                    type: array
                    items:
                      type: object
                      properties:
                        policyId:
                          type: string
                        policyName:
                          type: string
                        selectors:
                          type: object
                  xsdVersion:
                    type: string
                  appProfiles:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: number
                        filename:
                          type: string
                        createdBy:
                          type: string
                        dateCreated:
                          type: string
                        xsdVersion:
                          type: string
                  passwordServiceId:
                    type: number
                  accessProfileIds:
                    type: object
  /cc/api/app/getAccessProfiles/{id}:
    get:
      tags:
        - Applications
      summary: Get Access Profiles for Application
      operationId: GetApplicationAccessProfiles
      parameters:
        - name: id
          in: path
          schema:
            type: string
          example: 12345
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/app/create:
    post:
      tags:
        - Applications
      summary: Create Application
      operationId: CreateApplication
      security:
        - oauth2: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  example: 'My App'
                description:
                  type: string
                  format: 'This is my application'
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/app/update/{id}:
    post:
      tags:
        - Applications
      summary: Update Application
      operationId: UpdateApplication
      security:
        - oauth2: []
      parameters:
        - name: id
          in: path
          schema:
            type: string
          example: 12345
          required: true
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                  format: 'This is my application'
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/app/delete/{id}:
    post:
      tags:
        - Applications
      summary: Delete Application
      operationId: DeleteApplication
      security:
        - oauth2: []
      parameters:
        - name: id
          in: path
          schema:
            type: string
          example: 12345
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/connector/list:
    get:
      tags:
        - Connectors
      summary: List Connectors
      operationId: listConnectors
      security:
        - oauth2: []
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/connector/create:
    post:
      tags:
        - Connectors
      summary: Create Connector
      operationId: createConnector
      security:
        - oauth2: []
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                name:
                  type: string
                  example: My Connector
                description:
                  type: string
                  example: My Connector
                className:
                  type: string
                  example: sailpoint.connector.OpenConnectorAdapter
                directConnect:
                  type: boolean
                  example: 'true'
                status:
                  type: string
                  example: released
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/connector/delete/{id}:
    post:
      tags:
        - Connectors
      summary: Delete Connector
      operationId: deleteConnector
      security:
        - oauth2: []
      parameters:
        - name: id
          in: path
          schema:
            type: string
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/connector/export/{id}:
    get:
      tags:
        - Connectors
      summary: Export Connector Config
      operationId: exportConnectorConfig
      security:
        - oauth2: []
      parameters:
        - name: id
          in: path
          schema:
            type: string
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/connector/import/{id}:
    post:
      tags:
        - Connectors
      summary: Import Connector Config
      operationId: importConnectorConfig
      security:
        - oauth2: []
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  description: This is the connector config zip bundle which gets uploaded.
                  format: binary
      parameters:
        - name: id
          in: path
          schema:
            type: string
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/user/updatePermissions:
    post:
      tags:
        - User
      summary: Update User Permissions
      operationId: updateUserPermissions
      security:
        - oauth2: []
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                ids:
                  type: string
                  example: '71624,71625'
                isAdmin:
                  type: string
                  description: Indicates if user should be an IDN Admin.  "0" for false, "1" for true.
                  example: "1"
                adminType:
                  type: string
                  enum:
                    - ADMIN
                    - CERT_ADMIN
                    - HELPDESK
                    - REPORT_ADMIN
                    - ROLE_ADMIN
                    - ROLE_SUBADMIN
                    - SOURCE_ADMIN
                    - SOURCE_SUBADMIN
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/user/get/{id}:
    get:
      tags:
        - User
      summary: Get Single Identity
      operationId: GetIdentity
      security:
        - oauth2: []
      parameters:
        - name: id
          in: path
          schema:
            type: string
          example: 5433236
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  alias:
                    type: string
                  uid:
                    type: string
                  name:
                    type: string
                  displayName:
                    type: string
                  uuid:
                    type: string
                  encryptionKey:
                    type: object
                  encryptionCheck:
                    type: object
                  status:
                    type: string
                  pending:
                    type: boolean
                  passwordResetSinceLastLogin:
                    type: boolean
                  usageCertAttested:
                    type: object
                  userFlags:
                    type: object
                  enabled:
                    type: boolean
                  altAuthVia:
                    type: string
                  altAuthViaIntegrationData:
                    type: object
                  kbaAnswers:
                    type: number
                  disablePasswordReset:
                    type: boolean
                  ptaSourceId:
                    type: object
                  supportsPasswordPush:
                    type: boolean
                  attributes:
                    type: object
                  externalId:
                    type: string
                  role:
                    type: array
                    items:
                      type: object
                  phone:
                    type: object
                  email:
                    type: string
                  personalEmail:
                    type: object
                  employeeNumber:
                    type: object
                  riskScore:
                    type: number
                  featureFlags:
                    type: object
                  feature:
                    type: array
                    items:
                      type: string
                  orgEncryptionKey:
                    type: string
                  orgEncryptionKeyId:
                    type: string
                  meta:
                    type: object
                  org:
                    type: object
                    properties:
                      name:
                        type: string
                      scriptName:
                        type: string
                      mode:
                        type: string
                      numQuestions:
                        type: number
                      status:
                        type: string
                      maxRegisteredUsers:
                        type: number
                      pod:
                        type: string
                      pwdResetPersonalPhone:
                        type: boolean
                      pwdResetPersonalEmail:
                        type: boolean
                      pwdResetKba:
                        type: boolean
                      pwdResetEmail:
                        type: boolean
                      pwdResetDuo:
                        type: boolean
                      pwdResetPhoneMask:
                        type: boolean
                      authErrorText:
                        type: object
                      strongAuthKba:
                        type: boolean
                      strongAuthPersonalPhone:
                        type: boolean
                      strongAuthPersonalEmail:
                        type: boolean
                      integrations:
                        type: array
                        items:
                          type: object
                      productName:
                        type: string
                      kbaReqForAuthn:
                        type: number
                      kbaReqAnswers:
                        type: number
                      lockoutAttemptThreshold:
                        type: number
                      lockoutTimeMinutes:
                        type: number
                      usageCertRequired:
                        type: boolean
                      adminStrongAuthRequired:
                        type: boolean
                      enableExternalPasswordChange:
                        type: boolean
                      enablePasswordReplay:
                        type: boolean
                      enableAutomaticPasswordReplay:
                        type: boolean
                      notifyAuthenticationSettingChange:
                        type: boolean
                      netmasks:
                        type: object
                      countryCodes:
                        type: object
                      whiteList:
                        type: boolean
                      usernameEmptyText:
                        type: object
                      usernameLabel:
                        type: object
                      enableAutomationGeneration:
                        type: boolean
                      emailTestMode:
                        type: boolean
                      emailTestAddress:
                        type: string
                      orgType:
                        type: string
                      passwordReplayState:
                        type: string
                      systemNotificationConfig:
                        type: string
                      redirectPatterns:
                        type: string
                      maxClusterDebugHours:
                        type: string
                      brandName:
                        type: string
                      logo:
                        type: object
                      emailFromAddress:
                        type: object
                      standardLogoUrl:
                        type: object
                      narrowLogoUrl:
                        type: object
                      actionButtonColor:
                        type: string
                      activeLinkColor:
                        type: string
                      navigationColor:
                        type: string
                  stepUpAuth:
                    type: boolean
                  bxInstallPrompted:
                    type: boolean
                  federatedLogin:
                    type: boolean
                  auth:
                    type: object
                    properties:
                      service:
                        type: string
                      encryption:
                        type: string
                  onNetwork:
                    type: boolean
                  onTrustedGeo:
                    type: boolean
                  loginUrl:
                    type: string
  /cc/api/source/loadAccounts/{id}:
    post:
      tags:
        - Sources > Aggregation
      summary: Account Aggregation (File)
      operationId: loadAccounts
      security:
        - oauth2: []
      description: >-
        Aggregates a delimited file for the given source.  This only works for
        file-based sources.
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                disableOptimization:
                  type: boolean
                  example: 'true'
                file:
                  type: string
                  format: binary
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/x-www-form-urlencoded
        - name: id
          in: path
          schema:
            type: string
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/source/exportAccountFeed/{id}:
    get:
      tags:
        - Sources > Accounts
      summary: Export Account Feed
      operationId: exportAccountFeed
      security:
        - oauth2: []
      description: Exports a CSV of the accounts for a particular source.
      parameters:
        - name: id
          in: path
          schema:
            type: string
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
  /cc/api/system/refreshIdentities:
    post:
      tags:
        - System
      summary: Refresh Identities
      operationId: refreshIdentities
      security:
        - oauth2: []
      description: >-
        This kicks off an identity refresh for a specified set of identity
        attributes.  This can be a long running process.  IdentityNow has
        pre-scheduled versions of this task at set intervals and events already,
        so only run this when directed by SailPoint.


        _Note: If the identities specified by the filter do not exist, a full
        identity refresh will be run.  Use with caution._


        Refresh Arguments:


        | Key                   |
        Description                                        |

        |-----------------------|----------------------------------------------------|

        | correlateEntitlements | Analyzes entitlements, access profiles, and
        roles. |

        | promoteAttributes     | Calculates identity
        attributes.                    |

        | refreshManagerStatus  | Calculates manager correlation and manager
        status. |

        | synchronizeAttributes | Performs attribute sync
        provisioning.              |

        | pruneIdentities       | Removes any identities which don't have
        accounts.  |

        | provision             | Provisions any assigned roles or access
        profiles.  |
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                filter:
                  type: string
                  description: |
                    Defines the identity or identities which this refresh applies to.
                    The filter must use searchable identity attributes.
                    If the filter cannot be understood or parsed, all identities will be refreshed.
                refreshArgs:
                  type: object
                  properties:
                    correlateEntitlements:
                      type: boolean
                      example: true
                      description: This will refresh entitlement, role, and access profile calculations.
                    promoteAttributes:
                      type: boolean
                      example: true
                      description: This will calculate identity attributes.
                    refreshManagerStatus:
                      type: boolean
                      example: false
                      description: |
                        This recalculates manager correlation and manager status. Note: This is computationally expensive to run.
                    synchronizeAttributes:
                      type: boolean
                      example: false
                      description: Enables attribute synchronization.
                    pruneIdentities:
                      type: boolean
                      example: false
                      description: |
                        Option that will enable deletion of an identity objects if there are no account objects. Note: This is not typically used in IdentityNow, except by guidance from SailPoint.
                    provision:
                      type: boolean
                      example: false
                      description: Enables provisioning of role assignments with entitlements that are not currently fulfilled.
              example: >-
                "{\n   \"filter\" : \"uid == \\\"1219028\\\"\",\n  
                \"refreshArgs\" : {\n     \"correlateEntitlements\" :
                \"true\",\n     \"promoteAttributes\" : \"true\",\n    
                \"refreshManagerStatus\" : \"false\",\n    
                \"synchronizeAttributes\" : \"false\",\n     \"pruneIdentities\"
                : \"false\",\n     \"provision\" : \"true\"\n   }\n}"
      parameters:
        - name: Content-Type
          in: header
          schema:
            type: string
          example: application/json
      responses:
        '200':
          description: Successful response
          content:
            application/json: {}
