diff --git a/.github/ISSUE_TEMPLATE/bug-report.md b/.github/ISSUE_TEMPLATE/bug-report.md
index 5e1dc95e0..d556331ce 100644
--- a/.github/ISSUE_TEMPLATE/bug-report.md
+++ b/.github/ISSUE_TEMPLATE/bug-report.md
@@ -1,9 +1,9 @@
---
name: Bug Report
about: Create a report to help us improve.
-title: "[Bug] Your Bug Report Here"
-labels: ""
-assignees: ""
+title: '[Bug] Your Bug Report Here'
+labels: ''
+assignees: ''
---
**Describe the bug** A clear and concise description of what the bug is.
@@ -15,8 +15,7 @@ assignees: ""
3. Scroll down to '....'
4. See error
-**Expected behavior** A clear and concise description of what you expected to
-happen.
+**Expected behavior** A clear and concise description of what you expected to happen.
**Actual behavior** A clear and concise description of what actually happens.
diff --git a/.github/ISSUE_TEMPLATE/feature-request.md b/.github/ISSUE_TEMPLATE/feature-request.md
index aa0ec87d3..65754b9f2 100644
--- a/.github/ISSUE_TEMPLATE/feature-request.md
+++ b/.github/ISSUE_TEMPLATE/feature-request.md
@@ -1,19 +1,15 @@
---
name: Feature Request
about: Suggest an idea for this project.
-title: "[Feature] Your Feature Request Here"
-labels: ""
-assignees: ""
+title: '[Feature] Your Feature Request Here'
+labels: ''
+assignees: ''
---
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+**Is your feature request related to a problem? Please describe.** A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-**Describe the solution you'd like.**
-A clear and concise description of what you want to happen. Ex. It would be nice if [...]
+**Describe the solution you'd like.** A clear and concise description of what you want to happen. Ex. It would be nice if [...]
-**Describe alternatives you've considered.**
-A clear and concise description of any alternative solutions or features you've considered. Ex. I have seen similar features on [...]
+**Describe alternatives you've considered.** A clear and concise description of any alternative solutions or features you've considered. Ex. I have seen similar features on [...]
-**Additional context**
-Add any other context or screenshots about the feature request here.
+**Additional context** Add any other context or screenshots about the feature request here.
diff --git a/.github/bot.yml b/.github/bot.yml
index 3f59ea1ad..2fc8f7d92 100644
--- a/.github/bot.yml
+++ b/.github/bot.yml
@@ -92,10 +92,13 @@ addReviewerBasedOnLabel:
firstPRWelcomeComment: >
🎉 Thanks for opening this pull request! Please be sure to check out our contributing guidelines. 🙌
+
# Comment to be posted to congratulate user on their first merged PR
firstPRMergeComment: >
🎉 Awesome work, congrats on your first merged pull request! 🙌
+
# Comment to be posted to on first time issues
firstIssueWelcomeComment: >
🎉 Thanks for opening your first issue here! Be sure to follow the issue template, and welcome to the community! 🙌
+
diff --git a/.github/workflows/build-and-deploy-prod-gh-pages.yml b/.github/workflows/build-and-deploy-prod-gh-pages.yml
index 5c6b8f4da..64ed99fe3 100644
--- a/.github/workflows/build-and-deploy-prod-gh-pages.yml
+++ b/.github/workflows/build-and-deploy-prod-gh-pages.yml
@@ -3,10 +3,10 @@ name: Build/Deploy to GitHub Pages
on:
# Runs on pushes targeting the default branch
push:
- branches: ["main"]
+ branches: ['main']
paths-ignore:
- - "README.md"
- - ".github/**"
+ - 'README.md'
+ - '.github/**'
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
@@ -19,11 +19,11 @@ permissions:
# Allow one concurrent deployment
concurrency:
- group: "pages"
+ group: 'pages'
cancel-in-progress: true
env:
- BASE_URL: "/"
+ BASE_URL: '/'
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
@@ -37,7 +37,7 @@ jobs:
- name: Set up Node
uses: actions/setup-node@v3
with:
- node-version: "16"
+ node-version: '16'
# Install and build Developer Community site
- name: Build Developer Community site
run: |
diff --git a/.github/workflows/firebase-hosting-pull-request.yml b/.github/workflows/firebase-hosting-pull-request.yml
index dfb2ddcc6..055deadad 100644
--- a/.github/workflows/firebase-hosting-pull-request.yml
+++ b/.github/workflows/firebase-hosting-pull-request.yml
@@ -2,18 +2,18 @@
# https://github.com/firebase/firebase-tools
name: Deploy to Firebase Hosting on PR
-"on": pull_request
+'on': pull_request
jobs:
build_and_preview:
- if: "${{ github.event.pull_request.head.repo.full_name == github.repository }}"
+ if: '${{ github.event.pull_request.head.repo.full_name == github.repository }}'
runs-on: ubuntu-latest
env:
- NODE_ENV: "development"
+ NODE_ENV: 'development'
steps:
- uses: actions/checkout@v2
- run: npm ci && npm run gen-api-docs-all && npm run build
- uses: FirebaseExtended/action-hosting-deploy@v0
with:
- repoToken: "${{ secrets.GITHUB_TOKEN }}"
- firebaseServiceAccount: "${{ secrets.FIREBASE_SERVICE_ACCOUNT_DEVELOPER_COMMUNITY_SITE }}"
+ repoToken: '${{ secrets.GITHUB_TOKEN }}'
+ firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_DEVELOPER_COMMUNITY_SITE }}'
projectId: developer-community-site
diff --git a/.prettierrc b/.prettierrc
index 9bbd304c9..d17d2ebb7 100644
--- a/.prettierrc
+++ b/.prettierrc
@@ -1,9 +1,9 @@
{
- "arrowParens": "always",
- "bracketSpacing": false,
- "bracketSameLine": true,
- "printWidth": 80,
- "proseWrap": "never",
- "singleQuote": true,
- "trailingComma": "all"
- }
\ No newline at end of file
+ "arrowParens": "always",
+ "bracketSpacing": false,
+ "bracketSameLine": true,
+ "printWidth": 80,
+ "proseWrap": "never",
+ "singleQuote": true,
+ "trailingComma": "all"
+}
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 0a65a629a..98aa4be4a 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -2,127 +2,78 @@
## Our Pledge
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
## Our Standards
-Examples of behavior that contributes to a positive environment for our
-community include:
+Examples of behavior that contributes to a positive environment for our community include:
- Demonstrating empathy and kindness toward other people
- Being respectful of differing opinions, viewpoints, and experiences
- Giving and gracefully accepting constructive feedback
-- Accepting responsibility and apologizing to those affected by our mistakes,
- and learning from the experience
-- Focusing on what is best not just for us as individuals, but for the
- overall community
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall community
Examples of unacceptable behavior include:
-- The use of sexualized language or imagery, and sexual attention or
- advances of any kind
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
- Trolling, insulting or derogatory comments, and personal or political attacks
- Public or private harassment
-- Publishing others' private information, such as a physical or email
- address, without their explicit permission
-- Other conduct which could reasonably be considered inappropriate in a
- professional setting
+- Publishing others' private information, such as a physical or email address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
## Enforcement Responsibilities
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
## Scope
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
## Enforcement
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-https://developer.sailpoint.com/discuss/c/feedback/.
-All complaints will be reviewed and investigated promptly and fairly.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at https://developer.sailpoint.com/discuss/c/feedback/. All complaints will be reviewed and investigated promptly and fairly.
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
## Enforcement Guidelines
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
### 1. Correction
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
### 2. Warning
-**Community Impact**: A violation through a single incident or series
-of actions.
+**Community Impact**: A violation through a single incident or series of actions.
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
### 3. Temporary Ban
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
### 4. Permanent Ban
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
+**Consequence**: A permanent ban from any sort of public interaction within the community.
## Attribution
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0, available at https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
[homepage]: https://www.contributor-covenant.org
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.
+For answers to common questions about this code of conduct, see the FAQ at https://www.contributor-covenant.org/faq. Translations are available at https://www.contributor-covenant.org/translations.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index e1666e8ad..c3e100199 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,7 +1,6 @@
# Contributing to developer.sailpoint.com
-We love your input! We want to make contributing to this project as easy and
-transparent as possible. Look below if you would like to:
+We love your input! We want to make contributing to this project as easy and transparent as possible. Look below if you would like to:
- [Report an issue](#reporting-issues)
- [Make a feature request](#making-feature-requests)
@@ -13,14 +12,11 @@ transparent as possible. Look below if you would like to:
## We Develop with GitHub
-We use GitHub to host code, track issues and feature requests, and
-accept pull requests.
+We use GitHub to host code, track issues and feature requests, and accept pull requests.
## We Use GitHub Flow
-Pull requests are the best way to propose changes to the codebase, and
-[Github Flow](https://docs.github.com/en/get-started/quickstart/github-flow) is our preferred method of accepting pull requests.
-The basics of GitHub flow are as follows:
+Pull requests are the best way to propose changes to the codebase, and [Github Flow](https://docs.github.com/en/get-started/quickstart/github-flow) is our preferred method of accepting pull requests. The basics of GitHub flow are as follows:
1. Fork the repo and create your branch from `main`.
2. Make your changes.
@@ -28,9 +24,7 @@ The basics of GitHub flow are as follows:
## We Use the MIT Software License
-In short, when you submit code changes, your submissions are understood to be
-under the same [MIT License](http://choosealicense.com/licenses/mit/) that
-covers the project.
+In short, when you submit code changes, your submissions are understood to be under the same [MIT License](http://choosealicense.com/licenses/mit/) that covers the project.
# Reporting Issues
@@ -47,8 +41,7 @@ Our maintainers _love_ thorough bug reports. **Great bug reports** tend to have:
- Screenshots!
- Operating System
- Browser
-- Notes (possibly including why you think this might be happening, or stuff you
- tried that didn't work)
+- Notes (possibly including why you think this might be happening, or stuff you tried that didn't work)
# Making Feature Requests
@@ -76,19 +69,13 @@ Looking to add a new feature yourself? Great! Here are the steps to contribute a
- Fork the repository, copy the main branch only
- Pull down the code, build, and ensure it's running properly
-- Create a new branch from main with the naming convention
- `feature/your-feature-name`
+- Create a new branch from main with the naming convention `feature/your-feature-name`
- Create a pull request from your branch to our origin repository's main branch!
# Discussing General Issues or Questions
-If none of the above options work for you, you can submit a general issue using GitHub's
-[issues](https://github.com/sailpoint-oss/developer.sailpoint.com/issues). You
-can also head over to the
-[Developer Community forum](https://developer.sailpoint.com/discuss) to discuss
-with us directly on the forum about what you're thinking!
+If none of the above options work for you, you can submit a general issue using GitHub's [issues](https://github.com/sailpoint-oss/developer.sailpoint.com/issues). You can also head over to the [Developer Community forum](https://developer.sailpoint.com/discuss) to discuss with us directly on the forum about what you're thinking!
# License
-By contributing, you agree that your contributions will be licensed under the
-MIT License.
+By contributing, you agree that your contributions will be licensed under the MIT License.
diff --git a/README.md b/README.md
index 839275cb0..8f4942304 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,6 @@
-[![Discourse Topics][discourse-shield]][discourse-url] ![Issues][issues-shield]
-![Latest Releases][release-shield] ![Contributor Shield][contributor-shield]
-[](https://github.com/sailpoint-oss/developer.sailpoint.com/actions/workflows/build-and-deploy-prod-gh-pages.yml)
+[![Discourse Topics][discourse-shield]][discourse-url] ![Issues][issues-shield] ![Latest Releases][release-shield] ![Contributor Shield][contributor-shield] [](https://github.com/sailpoint-oss/developer.sailpoint.com/actions/workflows/build-and-deploy-prod-gh-pages.yml)
[discourse-shield]: https://img.shields.io/discourse/topics?label=Discuss%20This%20Tool&server=https%3A%2F%2Fdeveloper.sailpoint.com%2Fdiscuss
[discourse-url]: https://developer.sailpoint.com/discuss/
@@ -26,20 +24,11 @@
## About The Project
-This repository contains the complete build, with assets, for everything seen on
-developer.sailpoint.com. This includes the homepage, all static elements,
-_documentation_, API specifications, et. al. The API specifications come in from
-a GitHub Action in another repository, but ultimately the API specifications
-used to generate this static site are those found in the `static` folder.
+This repository contains the complete build, with assets, for everything seen on developer.sailpoint.com. This includes the homepage, all static elements, _documentation_, API specifications, et. al. The API specifications come in from a GitHub Action in another repository, but ultimately the API specifications used to generate this static site are those found in the `static` folder.
-Please use GitHub
-[issues](https://github.com/sailpoint-oss/developer.sailpoint.com/issues) to
-[submit bugs](https://github.com/sailpoint-oss/developer.sailpoint.com/issues/new?assignees=&labels=&template=bug-report.md&title=%5BBug%5D+Your+Bug+Report+Here)
-or make
-[feature requests](https://github.com/sailpoint-oss/developer.sailpoint.com/issues/new?assignees=&labels=&template=feature-request.md&title=%5BFeature%5D+Your+Feature+Request+Here).
+Please use GitHub [issues](https://github.com/sailpoint-oss/developer.sailpoint.com/issues) to [submit bugs](https://github.com/sailpoint-oss/developer.sailpoint.com/issues/new?assignees=&labels=&template=bug-report.md&title=%5BBug%5D+Your+Bug+Report+Here) or make [feature requests](https://github.com/sailpoint-oss/developer.sailpoint.com/issues/new?assignees=&labels=&template=feature-request.md&title=%5BFeature%5D+Your+Feature+Request+Here).
-If you'd like to contribute directly (which we encourage!) please read the
-contribution guidelines below, first!
+If you'd like to contribute directly (which we encourage!) please read the contribution guidelines below, first!
@@ -69,8 +58,7 @@ npm install npm@latest -g
npm install
```
-3. Generate the API docs. They are auto-generated, so we do not track them in
- the repository and instead build them at runtime.
+3. Generate the API docs. They are auto-generated, so we do not track them in the repository and instead build them at runtime.
```bash
npm run gen-api-docs-all
@@ -83,31 +71,24 @@ npm install npm@latest -g
## Discuss
-[Click Here](https://developer.sailpoint.com/discuss) to discuss this tool with
-other users.
+[Click Here](https://developer.sailpoint.com/discuss) to discuss this tool with other users.
## License
-Distributed under the MIT License. See [the license](./LICENSE) for more
-information.
+Distributed under the MIT License. See [the license](./LICENSE) for more information.
## Contributing
-Before you contribute you
-[must sign our CLA](https://cla-assistant.io/sailpoint-oss/developer.sailpoint.com).
-Please also read our [contribution guidelines](./CONTRIBUTING.md) for all the
-details on contributing.
+Before you contribute you [must sign our CLA](https://cla-assistant.io/sailpoint-oss/developer.sailpoint.com). Please also read our [contribution guidelines](./CONTRIBUTING.md) for all the details on contributing.
## Code of Conduct
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community. Read our
-[code of conduct](./CODE_OF_CONDUCT.md) to learn more.
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. Read our [code of conduct](./CODE_OF_CONDUCT.md) to learn more.
-1. **Access Token Request** - The HTTP client (a script, application, Postman,
- cURL, etc.) makes a request to IdentityNow to get an `access_token`. The
- details of this are described in the
- [Authentication Details](#authentication-details) section.
-2. **Access Token Response** - Assuming the request is valid, IdentityNow will
- issue an `access_token` to the HTTP client in response.
-3. **API Request** - The HTTP client makes a request to an IdentityNow API
- endpoint. Included in that request is the header
- `Authorization: Bearer {access_token}`.
-4. **API Response** - Assuming the request and the `access_token` are valid,
- IdentityNow will return a response to the client. If unexpected errors occur,
- see the [Troubleshooting](#troubleshooting) section of this document.
+1. **Access Token Request** - The HTTP client (a script, application, Postman, cURL, etc.) makes a request to IdentityNow to get an `access_token`. The details of this are described in the [Authentication Details](#authentication-details) section.
+2. **Access Token Response** - Assuming the request is valid, IdentityNow will issue an `access_token` to the HTTP client in response.
+3. **API Request** - The HTTP client makes a request to an IdentityNow API endpoint. Included in that request is the header `Authorization: Bearer {access_token}`.
+4. **API Response** - Assuming the request and the `access_token` are valid, IdentityNow will return a response to the client. If unexpected errors occur, see the [Troubleshooting](#troubleshooting) section of this document.
-The SailPoint authentication/authorization model is fully
-[OAuth 2.0](https://oauth.net/2/) compliant, with issued `access_tokens`
-leveraging the [JSON Web Token (JWT)](https://jwt.io/) standard. This document
-provides the necessary information for interacting with SailPoint's OAuth2
-services.
+The SailPoint authentication/authorization model is fully [OAuth 2.0](https://oauth.net/2/) compliant, with issued `access_tokens` leveraging the [JSON Web Token (JWT)](https://jwt.io/) standard. This document provides the necessary information for interacting with SailPoint's OAuth2 services.
## Find Your Tenant's OAuth Details
-This document assumes your IDN instance is using the domain name supplied by
-SailPoint. If your instance is using a vanity URL, then you will need to open
-the following URL in your browser to get your OAuth info. See
-[finding your org/tenant name](./getting-started.md#finding-your-orgtenant-name)
-in the [getting started guide](./getting-started.md) to get your `{tenant}`.
+This document assumes your IDN instance is using the domain name supplied by SailPoint. If your instance is using a vanity URL, then you will need to open the following URL in your browser to get your OAuth info. See [finding your org/tenant name](./getting-started.md#finding-your-orgtenant-name) in the [getting started guide](./getting-started.md) to get your `{tenant}`.
`https://{tenant}.api.identitynow.com/oauth/info`
-This page will present you with your `authorizeEndpoint` and `tokenEndpoint`,
-which you will need to follow along with the examples in this document.
+This page will present you with your `authorizeEndpoint` and `tokenEndpoint`, which you will need to follow along with the examples in this document.
```json
{
@@ -91,98 +67,53 @@ which you will need to follow along with the examples in this document.
## Personal Access Tokens
-A personal access token is a method of authenticating to an API as a user
-without needing to supply a username and password. The primary use case for
-personal access tokens is in scripts or programs that don't have an easy way to
-implement an OAuth 2.0 flow and that need to call API endpoints that require a
-user context. Personal access tokens are also convenient when using Postman to
-explore and test APIs.
+A personal access token is a method of authenticating to an API as a user without needing to supply a username and password. The primary use case for personal access tokens is in scripts or programs that don't have an easy way to implement an OAuth 2.0 flow and that need to call API endpoints that require a user context. Personal access tokens are also convenient when using Postman to explore and test APIs.
:::info Update
-Previously, only users with the `Admin` or `Source Admin` role were allowed to
-generate personal access tokens. Now, all users are able to generate personal
-access tokens!
+Previously, only users with the `Admin` or `Source Admin` role were allowed to generate personal access tokens. Now, all users are able to generate personal access tokens!
:::
-To generate a personal access token from the IdentityNow UI, perform the
-following steps after logging into your IdentityNow instance:
+To generate a personal access token from the IdentityNow UI, perform the following steps after logging into your IdentityNow instance:
-1. Select **Preferences** from the drop-down menu under your username, then
- **Personal Access Tokens** on the left. You can also go straight to the page
- using this URL, replacing `{tenant}` with your IdentityNow tenant:
- `https://{tenant}.identitynow.com/ui/d/user-preferences/personal-access-tokens`.
+1. Select **Preferences** from the drop-down menu under your username, then **Personal Access Tokens** on the left. You can also go straight to the page using this URL, replacing `{tenant}` with your IdentityNow tenant: `https://{tenant}.identitynow.com/ui/d/user-preferences/personal-access-tokens`.
-2. Click **New Token** and enter a meaningful description to help differentiate
- the token from others.
+2. Click **New Token** and enter a meaningful description to help differentiate the token from others.
:::caution
-The **New Token** button will be disabled when you’ve reached the limit of 10
-personal access tokens per user. To avoid reaching this limit, we recommend you
-delete any tokens that are no longer needed.
+The **New Token** button will be disabled when you’ve reached the limit of 10 personal access tokens per user. To avoid reaching this limit, we recommend you delete any tokens that are no longer needed.
:::
-3. Click **Create Token** to generate and view the two components that comprise
- the token: the `Secret` and the `Client ID`.
+3. Click **Create Token** to generate and view the two components that comprise the token: the `Secret` and the `Client ID`.
:::danger Important
-After you create the token, the value of the `Client ID` will be visible in the
-Personal Access Tokens list, but the corresponding `Secret` will not be visible
-after you close the window. You will need to store the `Secret` somewhere
-secure.
+After you create the token, the value of the `Client ID` will be visible in the Personal Access Tokens list, but the corresponding `Secret` will not be visible after you close the window. You will need to store the `Secret` somewhere secure.
:::
-4. Copy both values somewhere that will be secure and accessible to you when you
- need to use the the token.
+4. Copy both values somewhere that will be secure and accessible to you when you need to use the the token.
-To generate a personal access token from the API, use the
-[create personal access token endpoint](/idn/api/beta/create-personal-access-token).
+To generate a personal access token from the API, use the [create personal access token endpoint](/idn/api/beta/create-personal-access-token).
-To use a personal access token to generate an `access_token` that can be used to
-authenticate requests to the API, follow the
-[Client Credentials Grant Flow](#client-credentials-grant-flow), using the
-`Client ID` and `Client Secret` obtained from the personal access token.
+To use a personal access token to generate an `access_token` that can be used to authenticate requests to the API, follow the [Client Credentials Grant Flow](#client-credentials-grant-flow), using the `Client ID` and `Client Secret` obtained from the personal access token.
## OAuth 2.0
-[OAuth 2.0](https://oauth.net/2/) is an industry-standard protocol for
-authorization, and provides a variety of authorization flows for web
-applications, desktop applications, mobile phones, and devices. This
-specification and its extensions are developed within the
-[IETF OAuth Working Group](https://www.ietf.org/mailman/listinfo/oauth).
+[OAuth 2.0](https://oauth.net/2/) is an industry-standard protocol for authorization, and provides a variety of authorization flows for web applications, desktop applications, mobile phones, and devices. This specification and its extensions are developed within the [IETF OAuth Working Group](https://www.ietf.org/mailman/listinfo/oauth).
-There are several different authorization flows that OAuth 2.0 supports, and
-each of these has a grant-type which defines the different use cases. Some of
-the common ones which might be used with IdentityNow are as follows:
+There are several different authorization flows that OAuth 2.0 supports, and each of these has a grant-type which defines the different use cases. Some of the common ones which might be used with IdentityNow are as follows:
-1. [**Authorization Code**](https://oauth.net/2/grant-types/authorization-code/) -
- This grant type is used by clients to exchange an authorization code for an
- `access_token`. This is mainly used for web applications as there is a login
- into IdentityNow, with a subsequent redirect back to the web application /
- client.
-2. [**Client Credentials**](https://oauth.net/2/grant-types/client-credentials/) -
- This grant type is used by clients to obtain an `access_token` outside the
- context of a user. Because this is outside of a user context, only a subset
- of IdentityNow REST APIs may be accessible with this kind of grant type.
-3. [**Refresh Token**](https://oauth.net/2/grant-types/refresh-token/) - This
- grant type is used by clients in order to exchange a refresh token for a new
- `access_token` when the existing `access_token` has expired. This allows
- clients to continue using the API without having to re-authenticate as
- frequently. This grant type is commonly used together with
- `Authorization Code` to prevent a user from having to log in several times
- per day.
+1. [**Authorization Code**](https://oauth.net/2/grant-types/authorization-code/) - This grant type is used by clients to exchange an authorization code for an `access_token`. This is mainly used for web applications as there is a login into IdentityNow, with a subsequent redirect back to the web application / client.
+2. [**Client Credentials**](https://oauth.net/2/grant-types/client-credentials/) - This grant type is used by clients to obtain an `access_token` outside the context of a user. Because this is outside of a user context, only a subset of IdentityNow REST APIs may be accessible with this kind of grant type.
+3. [**Refresh Token**](https://oauth.net/2/grant-types/refresh-token/) - This grant type is used by clients in order to exchange a refresh token for a new `access_token` when the existing `access_token` has expired. This allows clients to continue using the API without having to re-authenticate as frequently. This grant type is commonly used together with `Authorization Code` to prevent a user from having to log in several times per day.
## JSON Web Token (JWT)
-[JSON Web Token (JWT)](https://jwt.io) is an industry-standard protocol for
-creating access tokens which assert various claims about the resource who has
-authenticated. The tokens have a specific structure consisting of a header,
-payload, and signature.
+[JSON Web Token (JWT)](https://jwt.io) is an industry-standard protocol for creating access tokens which assert various claims about the resource who has authenticated. The tokens have a specific structure consisting of a header, payload, and signature.
A raw JWT might look like this:
@@ -242,43 +173,29 @@ You can check the JWT access token data online at [jwt.io](https://jwt.io).
## Authentication Details
-This section details how to call the SailPoint Platform OAuth 2.0 token
-endpoints to get an `access_token`.
+This section details how to call the SailPoint Platform OAuth 2.0 token endpoints to get an `access_token`.
### Prerequisites
-Before any OAuth 2.0 token requests can be initiated, a Client ID and secret are
-necessary. As an `ORG_ADMIN`, browse to your API Management Admin Page at
-`https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel`
-and create an API client with the appropriate grant types for your use case. If
-you are not an admin of your org, you can ask an admin to create this for you.
-Be sure to save your `Client Secret` somewhere secure, as you will not be able
-to view or change it later.
+Before any OAuth 2.0 token requests can be initiated, a Client ID and secret are necessary. As an `ORG_ADMIN`, browse to your API Management Admin Page at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel` and create an API client with the appropriate grant types for your use case. If you are not an admin of your org, you can ask an admin to create this for you. Be sure to save your `Client Secret` somewhere secure, as you will not be able to view or change it later.
### OAuth 2.0 Token Request
-When authenticating to IdentityNow, the OAuth 2.0 token endpoint resides on the
-IdentityNow API Gateway at:
+When authenticating to IdentityNow, the OAuth 2.0 token endpoint resides on the IdentityNow API Gateway at:
```text
POST https://{tenant}.api.identitynow.com/oauth/token
```
-How you call this endpoint to get your token depends largely on the OAuth 2.0
-flow and grant type you wish to implement. The details for each grant type
-within IdentityNow are described in the following sections.
+How you call this endpoint to get your token depends largely on the OAuth 2.0 flow and grant type you wish to implement. The details for each grant type within IdentityNow are described in the following sections.
### Authorization Code Grant Flow
-Further Reading:
-[https://oauth.net/2/grant-types/authorization-code/](https://oauth.net/2/grant-types/authorization-code/)
+Further Reading: [https://oauth.net/2/grant-types/authorization-code/](https://oauth.net/2/grant-types/authorization-code/)
-This grant type is used by clients to exchange an authorization code for an
-`access_token`. This is mainly used for web apps as there is a login into
-IdentityNow, with a subsequent redirect back to the web app / client.
+This grant type is used by clients to exchange an authorization code for an `access_token`. This is mainly used for web apps as there is a login into IdentityNow, with a subsequent redirect back to the web app / client.
-The OAuth 2.0 client you are using must have `AUTHORIZATION_CODE` as one of its
-grant types. The redirect URLs must also match the list in the client as well:
+The OAuth 2.0 client you are using must have `AUTHORIZATION_CODE` as one of its grant types. The redirect URLs must also match the list in the client as well:
```json
{
@@ -330,41 +247,33 @@ sequenceDiagram
GET https://{tenant}.identitynow.com/oauth/authorize?client_id={client-id}&client_secret={client-secret}&response_type=code&redirect_uri={redirect-url}
```
-3. IdentityNow redirects the user to a login prompt to authenticate to
- IdentityNow.
+3. IdentityNow redirects the user to a login prompt to authenticate to IdentityNow.
4. The user authenticates to IdentityNow.
-5. Once authentication is successful, IdentityNow issues an authorization code
- back to the web app.
+5. Once authentication is successful, IdentityNow issues an authorization code back to the web app.
-6. The web app submits an **OAuth 2.0 Token Request** to IdentityNow in the
- form:
+6. The web app submits an **OAuth 2.0 Token Request** to IdentityNow in the form:
```text
POST https://{tenant}.api.identitynow.com/oauth/token?grant_type=authorization_code&client_id={client-id}&client_secret={client-secret}&code={code}&redirect_uri={redirect-url}
```
-> **Note**: the token endpoint URL is `{tenant}.api.identitynow.com`, while the
-> authorize URL is `{tenant}.identitynow.com`. Be sure to use the correct URL
-> when setting up your webapp to use this flow.
+> **Note**: the token endpoint URL is `{tenant}.api.identitynow.com`, while the authorize URL is `{tenant}.identitynow.com`. Be sure to use the correct URL when setting up your webapp to use this flow.
-7. IdentityNow validates the token request and submits a response. If
- successful, the response will contain a JWT `access_token`.
+7. IdentityNow validates the token request and submits a response. If successful, the response will contain a JWT `access_token`.
-The query parameters in the OAuth 2.0 token request for the Authorization Code
-grant are as follows:
+The query parameters in the OAuth 2.0 token request for the Authorization Code grant are as follows:
-| Key | Description |
-| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `grant_type` | Set to `authorization_code` for the authorization code grant type. |
-| `client_id` | This is the client ID for the API client (e.g. `b61429f5-203d-494c-94c3-04f54e17bc5c`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel` |
+| Key | Description |
+| --- | --- |
+| `grant_type` | Set to `authorization_code` for the authorization code grant type. |
+| `client_id` | This is the client ID for the API client (e.g. `b61429f5-203d-494c-94c3-04f54e17bc5c`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel` |
| `client_secret ` | This is the client secret for the API client (e.g. `c924417c85b19eda40e171935503d8e9747ca60ddb9b48ba4c6bb5a7145fb6c5`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel` |
-| `code` | This is a code returned by `/oauth/authorize`. |
-| `redirect_uri` | This is a URL of the application to redirect to once the token has been granted. |
+| `code` | This is a code returned by `/oauth/authorize`. |
+| `redirect_uri` | This is a URL of the application to redirect to once the token has been granted. |
-Here is an example OAuth 2.0 token request for the Authorization Code grant
-type.
+Here is an example OAuth 2.0 token request for the Authorization Code grant type.
```bash
curl -X POST \
@@ -374,20 +283,11 @@ curl -X POST \
### Client Credentials Grant Flow
-Further Reading:
-[https://oauth.net/2/grant-types/client-credentials/](https://oauth.net/2/grant-types/client-credentials/)
+Further Reading: [https://oauth.net/2/grant-types/client-credentials/](https://oauth.net/2/grant-types/client-credentials/)
-This grant type is used by clients to obtain an access token outside the context
-of a user. This is probably the simplest authentication flow, but comes with a
-major drawback; API endpoints that require
-[user level permissions](https://documentation.sailpoint.com/saas/help/common/users/user_level_matrix.html)
-will not work. [Personal Access Tokens](#personal-access-tokens) are a form of
-Client Credentials that have a user context, so they do not share this drawback.
-However, the APIs that can be invoked with a personal access token depend on the
-permissions of the user that generated it.
+This grant type is used by clients to obtain an access token outside the context of a user. This is probably the simplest authentication flow, but comes with a major drawback; API endpoints that require [user level permissions](https://documentation.sailpoint.com/saas/help/common/users/user_level_matrix.html) will not work. [Personal Access Tokens](#personal-access-tokens) are a form of Client Credentials that have a user context, so they do not share this drawback. However, the APIs that can be invoked with a personal access token depend on the permissions of the user that generated it.
-An OAuth 2.0 client using the Client Credentials flow must have
-`CLIENT_CREDENTIALS` as one of its grantTypes:
+An OAuth 2.0 client using the Client Credentials flow must have `CLIENT_CREDENTIALS` as one of its grantTypes:
```json
{
@@ -404,8 +304,7 @@ An OAuth 2.0 client using the Client Credentials flow must have
}
```
-[Personal Access Tokens](#personal-access-tokens) are implicly granted a
-`CLIENT_CREDENTIALS` grant type.
+[Personal Access Tokens](#personal-access-tokens) are implicly granted a `CLIENT_CREDENTIALS` grant type.
The overall authorization flow looks like this:
@@ -415,20 +314,17 @@ The overall authorization flow looks like this:
POST https://{tenant}.api.identitynow.com/oauth/token?grant_type=client_credentials&client_id={client-id}&client_secret={client-secret}
```
-2. IdentityNow validates the token request and submits a response. If
- successful, the response will contain a JWT access token.
+2. IdentityNow validates the token request and submits a response. If successful, the response will contain a JWT access token.
-The query parameters in the OAuth 2.0 Token Request for the Client Credentials
-grant are as follows:
+The query parameters in the OAuth 2.0 Token Request for the Client Credentials grant are as follows:
-| Key | Description |
-| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `grant_type` | Set to `CLIENT_CREDENTIALS` for the authorization code grant type. |
-| `client_id` | This is the client ID describing for the API client (e.g. `b61429f5-203d-494c-94c3-04f54e17bc5c`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel` or by [creating a personal access token](#personal-access-tokens). |
+| Key | Description |
+| --- | --- |
+| `grant_type` | Set to `CLIENT_CREDENTIALS` for the authorization code grant type. |
+| `client_id` | This is the client ID describing for the API client (e.g. `b61429f5-203d-494c-94c3-04f54e17bc5c`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel` or by [creating a personal access token](#personal-access-tokens). |
| `client_secret` | This is the client secret describing for the API client (e.g. `c924417c85b19eda40e171935503d8e9747ca60ddb9b48ba4c6bb5a7145fb6c5`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel` or by [creating a personal access token](#personal-access-tokens). |
-Here is an example request to generate an `access_token` using Client
-Credentials.
+Here is an example request to generate an `access_token` using Client Credentials.
```bash
curl -X POST \
@@ -438,17 +334,11 @@ curl -X POST \
### Refresh Token Grant Flow
-Further Reading:
-[https://oauth.net/2/grant-types/refresh-token/](https://oauth.net/2/grant-types/refresh-token/)
+Further Reading: [https://oauth.net/2/grant-types/refresh-token/](https://oauth.net/2/grant-types/refresh-token/)
-This grant type is used by clients in order to exchange a refresh token for a
-new `access_token` once the existing `access_token` has expired. This allows
-clients to continue to have a valid `access_token` without the need for the user
-to login as frequently.
+This grant type is used by clients in order to exchange a refresh token for a new `access_token` once the existing `access_token` has expired. This allows clients to continue to have a valid `access_token` without the need for the user to login as frequently.
-The OAuth 2.0 client you are using must have `REFRESH_TOKEN` as one of its grant
-types, and is typically used in conjunction with another grant type, like
-`CLIENT_CREDENTIALS` or `AUTHORIZATION_CODE`:
+The OAuth 2.0 client you are using must have `REFRESH_TOKEN` as one of its grant types, and is typically used in conjunction with another grant type, like `CLIENT_CREDENTIALS` or `AUTHORIZATION_CODE`:
```json
{
@@ -468,29 +358,24 @@ types, and is typically used in conjunction with another grant type, like
The overall authorization flow looks like this:
-1. The client application receives an `access_token` and a `refresh_token` via
- one of the other OAuth grant flows, like `AUTHORIZATION_CODE`.
-2. The client application notices that the `access_token` is about to expire,
- based on the `expires_in` attribute contained within the JWT token.
+1. The client application receives an `access_token` and a `refresh_token` via one of the other OAuth grant flows, like `AUTHORIZATION_CODE`.
+2. The client application notices that the `access_token` is about to expire, based on the `expires_in` attribute contained within the JWT token.
3. The client submits an **OAuth 2.0 Token Request** to IdentityNow in the form:
```text
POST https://{tenant}.api.identitynow.com/oauth/token?grant_type=refresh_token&client_id={client_id}&client_secret={client_secret}&refresh_token={refresh_token}
```
-4. IdentityNow validates the token request and submits a response. If
- successful, the response will contain a new `access_token` and
- `refresh_token`.
+4. IdentityNow validates the token request and submits a response. If successful, the response will contain a new `access_token` and `refresh_token`.
-The query parameters in the OAuth 2.0 Token Request for the Refresh Token grant
-are as follows:
+The query parameters in the OAuth 2.0 Token Request for the Refresh Token grant are as follows:
-| Key | Description |
-| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `grant_type` | Set to `refresh_token` for the authorization code grant type. |
-| `client_id` | This is the client ID for the API client (e.g. `b61429f5-203d-494c-94c3-04f54e17bc5c`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel`. |
+| Key | Description |
+| --- | --- |
+| `grant_type` | Set to `refresh_token` for the authorization code grant type. |
+| `client_id` | This is the client ID for the API client (e.g. `b61429f5-203d-494c-94c3-04f54e17bc5c`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel`. |
| `client_secret` | This is the client secret for the API client (e.g. `c924417c85b19eda40e171935503d8e9747ca60ddb9b48ba4c6bb5a7145fb6c5`). This can be generated at `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel`. |
-| `refresh_token` | This is the `refresh_token` that was provided along with the now expired `access_token`. |
+| `refresh_token` | This is the `refresh_token` that was provided along with the now expired `access_token`. |
Here is an example call OAuth 2.0 Token Request for the Refresh Token grant.
@@ -502,8 +387,7 @@ curl -X POST \
## OAuth 2.0 Token Response
-A successful request to `https://{tenant}.api.identitynow.com/oauth/token` will
-contain a response body similar to this:
+A successful request to `https://{tenant}.api.identitynow.com/oauth/token` will contain a response body similar to this:
```json
{
@@ -526,10 +410,7 @@ contain a response body similar to this:
}
```
-The `access_token` contains the JSON Web Token which is subsequently used in any
-further REST API calls through the IdentityNow API gateway. To use the
-`access_token`, simply include it in the `Authorization` header as a `Bearer`
-token. For example:
+The `access_token` contains the JSON Web Token which is subsequently used in any further REST API calls through the IdentityNow API gateway. To use the `access_token`, simply include it in the `Authorization` header as a `Bearer` token. For example:
```bash
curl -X GET \
@@ -538,76 +419,42 @@ curl -X GET \
-H 'cache-control: no-cache'
```
-The `expires_in` describes the lifetime, in seconds, of the `access_token`. For
-example, the value 749 means that the `access_token` will expire in 12.5 minutes
-from the time the response was generated. The exact expiration date is also
-contained within the `access_token`. You can view this expiration time by
-decoding the JWT `access_token` using a tool like [jwt.io](https://jwt.io/).
+The `expires_in` describes the lifetime, in seconds, of the `access_token`. For example, the value 749 means that the `access_token` will expire in 12.5 minutes from the time the response was generated. The exact expiration date is also contained within the `access_token`. You can view this expiration time by decoding the JWT `access_token` using a tool like [jwt.io](https://jwt.io/).
-The `refresh_token` contains a JSON Web Token for use in a
-[Refresh Token](#refresh-token-grant-flow) grant flow. The `refresh_token` will
-only be present if the API client has the `REFRESH_CODE` grant flow.
+The `refresh_token` contains a JSON Web Token for use in a [Refresh Token](#refresh-token-grant-flow) grant flow. The `refresh_token` will only be present if the API client has the `REFRESH_CODE` grant flow.
-The `user_id` and `identity_id` define the identity context of the person that
-authenticated. This is not set for the Client Credentials grant type since it
-doesn't have a user context.
+The `user_id` and `identity_id` define the identity context of the person that authenticated. This is not set for the Client Credentials grant type since it doesn't have a user context.
## Which OAuth 2.0 Grant Flow Should I use
-Deciding which OAuth 2.0 grant flow you should use largely depends on your use
-case.
+Deciding which OAuth 2.0 grant flow you should use largely depends on your use case.
### Daily Work or Quick Actions
-For daily work or short, quick administrative actions, you may not really need
-to worry about grant types, as an access token can easily be obtained in the
-user interface. In order to see this:
+For daily work or short, quick administrative actions, you may not really need to worry about grant types, as an access token can easily be obtained in the user interface. In order to see this:
1. Login to IdentityNow.
2. Go to `https://{tenant}.identitynow.com/ui/session`.
3. The `accessToken` is visible in the user interface.
-4. Use this access token in the `Authorization` header when making API calls. If
- the access token expires, log back into Identity Now and retrieve the new
- access token.
+4. Use this access token in the `Authorization` header when making API calls. If the access token expires, log back into Identity Now and retrieve the new access token.
-While this is very simple to use, this is only valid for a short period of time
-(a few minutes).
+While this is very simple to use, this is only valid for a short period of time (a few minutes).
### Postman
-If you are using the popular HTTP client, [Postman](https://www.getpostman.com),
-you have a couple of options on how you might setup your authorization. You can
-just leverage the accessToken as mentioned above, or you can also configure
-Postman to use OAuth 2.0 directly.
+If you are using the popular HTTP client, [Postman](https://www.getpostman.com), you have a couple of options on how you might setup your authorization. You can just leverage the accessToken as mentioned above, or you can also configure Postman to use OAuth 2.0 directly.
### Web Applications
-If you are making a web application, the best grant flow to use is the
-[Authorization Code](#authorization-code-grant-flow) grant flow. This will allow
-users to be directed to IdentityNow to login, and then redirected back to the
-web application via a URL redirect. This also works well with SSO, strong
-authentication, or pass-through authentication mechanisms.
+If you are making a web application, the best grant flow to use is the [Authorization Code](#authorization-code-grant-flow) grant flow. This will allow users to be directed to IdentityNow to login, and then redirected back to the web application via a URL redirect. This also works well with SSO, strong authentication, or pass-through authentication mechanisms.
-SailPoint does not recommend using a password grant flow for web applications as
-it would involve entering IdentityNow credentials in the web application. This
-flow also doesn't allow you to work with SSO, strong authentication, or
-pass-through authentication.
+SailPoint does not recommend using a password grant flow for web applications as it would involve entering IdentityNow credentials in the web application. This flow also doesn't allow you to work with SSO, strong authentication, or pass-through authentication.
### Scripts or Programs
-If you are writing scripts or programs that leverage the IdentityNow APIs, which
-OAuth 2.0 grant from you should use typically depends on what you are doing, and
-which user context you need to operate under.
+If you are writing scripts or programs that leverage the IdentityNow APIs, which OAuth 2.0 grant from you should use typically depends on what you are doing, and which user context you need to operate under.
-Because scripts, code, or programs do not have an interactive web-interface it
-is difficult, but not impossible, to implement a working
-[Authorization Code](#authorization-code-grant-flow) flow. Most scripts or
-programs typically run as a
-[Client Credentials](#client-credentials-grant-flow). If your APIs can work
-under an API context without a user, then
-[Client Credentials](#client-credentials-grant-flow) is ideal. However, if your
-APIs need a user or admin context, then the
-[Personal Access Token](#personal-access-tokens) approach will be more suitable.
+Because scripts, code, or programs do not have an interactive web-interface it is difficult, but not impossible, to implement a working [Authorization Code](#authorization-code-grant-flow) flow. Most scripts or programs typically run as a [Client Credentials](#client-credentials-grant-flow). If your APIs can work under an API context without a user, then [Client Credentials](#client-credentials-grant-flow) is ideal. However, if your APIs need a user or admin context, then the [Personal Access Token](#personal-access-tokens) approach will be more suitable.
## Troubleshooting
@@ -616,8 +463,7 @@ Having issues? Follow these steps.
1. **Verify the API End Point Calls**
1. Verify the structure of the API call:
-1. Verify that the API calls are going through the API gateway:
- `https://{tenant}.api.identitynow.com`
+1. Verify that the API calls are going through the API gateway: `https://{tenant}.api.identitynow.com`
1. Verify you are calling their version correctly:
- Private APIs: `https://{tenant}.api.identitynow.com/cc/api/{endpoint}`
@@ -625,33 +471,19 @@ Having issues? Follow these steps.
- V3 APIs: `https://{tenant}.api.identitynow.com/v3/{endpoint}`
- Beta APIs: `https://{tenant}.api.identitynow.com/beta/{endpoint}`
-1. Verify that the API calls have the correct headers (e.g., `content-type`),
- query parameters, and body data.
-1. If the HTTP response is **401 Unauthorized** , this is an indication that
- either there is no `Authorization` header or the `access_token` is invalid.
- Verify that the API calls are supplying the `access_token` in the
- `Authorization` header correctly (ex. `Authorization: Bearer {access_token}`)
- and that the `access_token` has not expired.
-1. If the HTTP response is **403 Forbidden**, this is an indication that the
- `access_token` is valid, but the user you are running as doesn't have access
- to this endpoint. Check the access rights which are associated with the user.
+1. Verify that the API calls have the correct headers (e.g., `content-type`), query parameters, and body data.
+1. If the HTTP response is **401 Unauthorized** , this is an indication that either there is no `Authorization` header or the `access_token` is invalid. Verify that the API calls are supplying the `access_token` in the `Authorization` header correctly (ex. `Authorization: Bearer {access_token}`) and that the `access_token` has not expired.
+1. If the HTTP response is **403 Forbidden**, this is an indication that the `access_token` is valid, but the user you are running as doesn't have access to this endpoint. Check the access rights which are associated with the user.
:::info
-This can also be due to calling an API which expects a user, but your
-authorization grant type might not have a user context. Calling most
-administrative APIs with a CLIENT_CREDENTIAL grant will often produce this
-result.
+This can also be due to calling an API which expects a user, but your authorization grant type might not have a user context. Calling most administrative APIs with a CLIENT_CREDENTIAL grant will often produce this result.
:::
2. **Verify the OAuth 2.0 Client**
-1. Verify that the OAuth 2.0 Client is not a Legacy OAuth client. Legacy OAuth
- clients will not work. This is very apparent by looking at the Client ID, as
- OAuth 2.0 Client IDs have dashes. Here is an example: Legacy Client ID:
- `G6xLlBBOKIcOAQuK` OAuth 2.0 Client ID:
- `b61429f5-203d-494c-94c3-04f54e17bc5c`
+1. Verify that the OAuth 2.0 Client is not a Legacy OAuth client. Legacy OAuth clients will not work. This is very apparent by looking at the Client ID, as OAuth 2.0 Client IDs have dashes. Here is an example: Legacy Client ID: `G6xLlBBOKIcOAQuK` OAuth 2.0 Client ID: `b61429f5-203d-494c-94c3-04f54e17bc5c`
1. Verify the OAuth 2.0 Client ID exists. This can be verified by calling:
@@ -665,14 +497,9 @@ or
GET /beta/oauth-clients/
```
-You can also view all of the active clients in the UI by going to
-`https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel`.
+You can also view all of the active clients in the UI by going to `https://{tenant}.identitynow.com/ui/admin/#admin:global:security:apimanagementpanel`.
-3. Verify that the OAuth 2.0 Client grant types match the OAuth 2.0 grant type
- flow you are trying to use. For instance, this client will work with
- [Authorization Code](#authorization-code-grant-flow) and
- [Client Credentials](#client-Credentials-grant-flow) flows, but not
- [Refresh Token](#refresh-token-grant-flow) flows:
+3. Verify that the OAuth 2.0 Client grant types match the OAuth 2.0 grant type flow you are trying to use. For instance, this client will work with [Authorization Code](#authorization-code-grant-flow) and [Client Credentials](#client-Credentials-grant-flow) flows, but not [Refresh Token](#refresh-token-grant-flow) flows:
```json
{
@@ -690,15 +517,8 @@ You can also view all of the active clients in the UI by going to
}
```
-4. If using an A[Authorization Code](#authorization-code-grant-flow) flow,
- verify the redirect URL(s) for your application match the `redirectUris`
- value in the client. You can check this using the
- [oauth-clients endpoint](/idn/api/beta/list-oauth-clients).
+4. If using an A[Authorization Code](#authorization-code-grant-flow) flow, verify the redirect URL(s) for your application match the `redirectUris` value in the client. You can check this using the [oauth-clients endpoint](/idn/api/beta/list-oauth-clients).
5. **Verify the OAuth 2.0 Calls**
-6. Verify that the OAuth call flow is going to the right URLs, with the correct
- query parameters and data values. A common source of errors is using the
- wrong host for authorization and token API calls. The token endpoint URL is
- `{tenant}.api.identitynow.com`, while the authorize URL is
- `{tenant}.identitynow.com`.
+6. Verify that the OAuth call flow is going to the right URLs, with the correct query parameters and data values. A common source of errors is using the wrong host for authorization and token API calls. The token endpoint URL is `{tenant}.api.identitynow.com`, while the authorize URL is `{tenant}.identitynow.com`.
diff --git a/products/idn/api/getting-started.md b/products/idn/api/getting-started.md
index 0b0ebc5a4..946ad1a1d 100644
--- a/products/idn/api/getting-started.md
+++ b/products/idn/api/getting-started.md
@@ -5,90 +5,57 @@ pagination_label: Getting Started
sidebar_label: Getting Started
sidebar_position: 1
sidebar_class_name: gettingStarted
-keywords: ["getting started"]
+keywords: ['getting started']
description: This is this place to get started with IdentityNow APIs.
slug: /api/getting-started
-tags: ["Getting Started"]
+tags: ['Getting Started']
---
## Find Your Tenant Name
-To form the proper URL for an API request, you must know your tenant name. To
-find your tenant name by log into IdentityNow, navigate to Admin, select the
-Dashboard dropdown, and select Overview. The org name is displayed within the
-Org Details section of the dashboard. If you do not have admin access, you can
-still find your tenant name and the API base URL you will use for API calls. To
-do so, view your session details when you are logged into your IdentityNow
-instance. Change your URL to the following:
-`https://{your-IdentityNow-hostname}.com/ui/session`, where
-`{your-IdentityNow-hostname}` is your company's domain name for accessing
-IdentityNow. The session detail you want is the `baseUrl`, which has the form of
-`https://{tenant}.api.identitynow.com`.
+To form the proper URL for an API request, you must know your tenant name. To find your tenant name by log into IdentityNow, navigate to Admin, select the Dashboard dropdown, and select Overview. The org name is displayed within the Org Details section of the dashboard. If you do not have admin access, you can still find your tenant name and the API base URL you will use for API calls. To do so, view your session details when you are logged into your IdentityNow instance. Change your URL to the following: `https://{your-IdentityNow-hostname}.com/ui/session`, where `{your-IdentityNow-hostname}` is your company's domain name for accessing IdentityNow. The session detail you want is the `baseUrl`, which has the form of `https://{tenant}.api.identitynow.com`.
## Make Your First API Call
-To get started, create a
-[personal access token](./authentication.md#personal-access-tokens), which can
-then be used to generate access tokens to authenticate your API calls. To
-generate a personal access token from IdentityNow, do the following after
-logging into your IdentityNow instance:
+To get started, create a [personal access token](./authentication.md#personal-access-tokens), which can then be used to generate access tokens to authenticate your API calls. To generate a personal access token from IdentityNow, do the following after logging into your IdentityNow instance:
-1. Select **Preferences** from the drop-down menu under your username. Then
- select **Personal Access Tokens** on the left. You can also go straight to
- the page using this URL, replacing `{tenant}` with your IdentityNow tenant:
- `https://{tenant}.identitynow.com/ui/d/user-preferences/personal-access-tokens`.
+1. Select **Preferences** from the drop-down menu under your username. Then select **Personal Access Tokens** on the left. You can also go straight to the page using this URL, replacing `{tenant}` with your IdentityNow tenant: `https://{tenant}.identitynow.com/ui/d/user-preferences/personal-access-tokens`.
-2. Select **New Token** and enter a meaningful description to differentiate the
- token from others.
+2. Select **New Token** and enter a meaningful description to differentiate the token from others.
:::caution
-The **New Token** button will be disabled when you reach the limit of 10
-personal access tokens per user. To avoid reaching this limit, delete any tokens
-that are no longer needed.
+The **New Token** button will be disabled when you reach the limit of 10 personal access tokens per user. To avoid reaching this limit, delete any tokens that are no longer needed.
:::
-3. Select **Create Token** to generate and view two components the token
- comprises: the `Secret` and the `Client ID`.
+3. Select **Create Token** to generate and view two components the token comprises: the `Secret` and the `Client ID`.
:::danger Important
- After you create the token, the value of the `Client ID` will be visible in
- the Personal Access Tokens list, but the corresponding `Secret` will not be
- visible after you close the window. Store the `Secret` somewhere secure.
+ After you create the token, the value of the `Client ID` will be visible in the Personal Access Tokens list, but the corresponding `Secret` will not be visible after you close the window. Store the `Secret` somewhere secure.
:::
-4. Copy both values somewhere that will be secure and accessible to you when you
- need to use the the token.
+4. Copy both values somewhere that will be secure and accessible to you when you need to use the the token.
-5. To create an `access_token` that can be used to authenticate API requests,
- use the following cURL command, replacing `{tenant}` with your IdentityNow
- tenant. The response body will contain an `access_token`, which will look
- like a long string of random characters.
+5. To create an `access_token` that can be used to authenticate API requests, use the following cURL command, replacing `{tenant}` with your IdentityNow tenant. The response body will contain an `access_token`, which will look like a long string of random characters.
```bash
curl --location --request POST 'https://{tenant}.api.identitynow.com/oauth/token?grant_type=client_credentials&client_id={client_id}&client_secret={secret}'
```
-6. To test your `access_token`, execute the following cURL command, replacing
- `{tenant}` with your IdentityNow tenant and `access_token` with the token you
- generated in the previous step. If this is successful, you should get a JSON
- representation of an identity in your tenant.
+6. To test your `access_token`, execute the following cURL command, replacing `{tenant}` with your IdentityNow tenant and `access_token` with the token you generated in the previous step. If this is successful, you should get a JSON representation of an identity in your tenant.
```bash
curl --request GET --url 'https://{tenant}.api.identitynow.com/v3/public-identities?limit=1' --header 'authorization: Bearer {access_token}'
```
-For more information about SailPoint Platform authentication, see
-[API Authentication](./authentication.md)
+For more information about SailPoint Platform authentication, see [API Authentication](./authentication.md)
## Rate Limits
-There is a rate limit of 100 requests per `access_token` per 10 seconds for V3
-API calls through the API gateway. If you exceed the rate limit, expect the
-following response from the API:
+There is a rate limit of 100 requests per `access_token` per 10 seconds for V3 API calls through the API gateway. If you exceed the rate limit, expect the following response from the API:
**HTTP Status Code**: 429 Too Many Requests
@@ -98,15 +65,7 @@ following response from the API:
## Authorization
-Each API resource requires a specific level of authorization attached to your
-`access_token`. You can view these levels of authorization in the
-[user level access matrix](https://documentation.sailpoint.com/saas/help/common/users/user_level_matrix.html).
-Review the authorization constraints for each API endpoint to understand the
-user level needed to invoke the endpoint. Tokens generated outside of a user
-context, like the
-[Client Credentials](./authentication.md#client-credentials-grant-flow) grant
-type, are limited in the endpoints that it can call. If your token does not have
-permission to call an endpoint, you will receive the following response:
+Each API resource requires a specific level of authorization attached to your `access_token`. You can view these levels of authorization in the [user level access matrix](https://documentation.sailpoint.com/saas/help/common/users/user_level_matrix.html). Review the authorization constraints for each API endpoint to understand the user level needed to invoke the endpoint. Tokens generated outside of a user context, like the [Client Credentials](./authentication.md#client-credentials-grant-flow) grant type, are limited in the endpoints that it can call. If your token does not have permission to call an endpoint, you will receive the following response:
**HTTP Status Code**: 403 Forbidden
@@ -128,10 +87,4 @@ permission to call an endpoint, you will receive the following response:
## API Tools
-There are several API tools that make exploring and testing APIs easier than
-using the command line or a programming language. One tool is
-[Postman](https://www.postman.com/downloads/). SailPoint provides an official
-Postman workspace where our collections are always up to date with the latest
-API changes.
-[Click here](https://developer.sailpoint.com/discuss/t/official-identitynow-postman-workspace/6153)
-to get started with our Postman workspace.
+There are several API tools that make exploring and testing APIs easier than using the command line or a programming language. One tool is [Postman](https://www.postman.com/downloads/). SailPoint provides an official Postman workspace where our collections are always up to date with the latest API changes. [Click here](https://developer.sailpoint.com/discuss/t/official-identitynow-postman-workspace/6153) to get started with our Postman workspace.
diff --git a/products/idn/api/rate-limit.md b/products/idn/api/rate-limit.md
index 038a3f5a5..fcdbf50f5 100644
--- a/products/idn/api/rate-limit.md
+++ b/products/idn/api/rate-limit.md
@@ -5,18 +5,14 @@ pagination_label: Rate Limiting
sidebar_label: Rate Limiting
sidebar_position: 4
sidebar_class_name: rateLimit
-keywords: ["rate limit"]
-description:
- There is a rate limit of 100 requests per access_token per 10 seconds for V3
- API calls through the API gateway.
-tags: ["Rate Limit"]
+keywords: ['rate limit']
+description: There is a rate limit of 100 requests per access_token per 10 seconds for V3 API calls through the API gateway.
+tags: ['Rate Limit']
---
## Rate Limits
-There is a rate limit of 100 requests per `access_token` per 10 seconds for V3
-API calls through the API gateway. If you exceed the rate limit, expect the
-following response from the API:
+There is a rate limit of 100 requests per `access_token` per 10 seconds for V3 API calls through the API gateway. If you exceed the rate limit, expect the following response from the API:
**HTTP Status Code**: 429 Too Many Requests
diff --git a/products/idn/api/standard-collection-parameters.md b/products/idn/api/standard-collection-parameters.md
index ce61496fa..ea81a3e4f 100644
--- a/products/idn/api/standard-collection-parameters.md
+++ b/products/idn/api/standard-collection-parameters.md
@@ -5,31 +5,26 @@ pagination_label: Standard Collection Parameters
sidebar_label: Standard Collection Parameters
sidebar_position: 3
sidebar_class_name: standardCollectionParameters
-keywords: ["standard collection parameters"]
-description:
- Many endpoints in the IdentityNow API support a generic syntax for paginating,
- filtering and sorting the results.
-tags: ["Standard Collection Parameters"]
+keywords: ['standard collection parameters']
+description: Many endpoints in the IdentityNow API support a generic syntax for paginating, filtering and sorting the results.
+tags: ['Standard Collection Parameters']
---
-Many endpoints in the IdentityNow API support a generic syntax for paginating,
-filtering and sorting the results. A collection endpoint has the following
-characteristics:
+Many endpoints in the IdentityNow API support a generic syntax for paginating, filtering and sorting the results. A collection endpoint has the following characteristics:
- The HTTP verb is always GET.
- The last component in the URL is a plural noun (ex. `/v3/public-identities`).
-- The return value from a successful request is always an array of JSON objects.
- This array may be empty if there are no results.
+- The return value from a successful request is always an array of JSON objects. This array may be empty if there are no results.
## Paginating Results
Use the following optional query parameters to achieve pagination:
-| Name | Description | Default | Constraints |
-| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------ |
-| `limit` | Integer specifying the maximum number of records to return in a single API call. If it is not specified, a default limit is used. | `250` | Maxiumum of 250 records per page |
-| `offset` | Integer specifying the offset of the first result from the beginning of the collection. The **offset** value is record-based, not page-based, and the index starts at 0. For example, **offset=0** and **limit=20** returns records 0-19, but **offset=1** and **limit=20** returns records 1-20. | `0` | Between 0 and the last record index. |
-| `count` | Boolean indicating whether a total count is returned, factoring in any filter parameters, in the **X-Total-Count** response header. The value is the total size of the collection that would be returned if **limit** and **offset** were ignored. For example, if the total number of records is 1000, then count=true would return 1000 in the **X-Total-Count** header. Because requesting a total count can have performance impact, do not send **count=true** if that value is not being used. | `false` | Must be `true` or `false` |
+| Name | Description | Default | Constraints |
+| --- | --- | --- | --- |
+| `limit` | Integer specifying the maximum number of records to return in a single API call. If it is not specified, a default limit is used. | `250` | Maxiumum of 250 records per page |
+| `offset` | Integer specifying the offset of the first result from the beginning of the collection. The **offset** value is record-based, not page-based, and the index starts at 0. For example, **offset=0** and **limit=20** returns records 0-19, but **offset=1** and **limit=20** returns records 1-20. | `0` | Between 0 and the last record index. |
+| `count` | Boolean indicating whether a total count is returned, factoring in any filter parameters, in the **X-Total-Count** response header. The value is the total size of the collection that would be returned if **limit** and **offset** were ignored. For example, if the total number of records is 1000, then count=true would return 1000 in the **X-Total-Count** header. Because requesting a total count can have performance impact, do not send **count=true** if that value is not being used. | `false` | Must be `true` or `false` |
Examples:
@@ -39,10 +34,7 @@ Examples:
## Filtering Results
-Any collection with a `filters` parameter supports filtering. This means that an
-item is only included in the returned array if the filters expression evaluates
-to true for that item. Check the available request parameters for the collection
-endpoint you are using to see if it supports filtering.
+Any collection with a `filters` parameter supports filtering. This means that an item is only included in the returned array if the filters expression evaluates to true for that item. Check the available request parameters for the collection endpoint you are using to see if it supports filtering.
### Data Types
@@ -51,51 +43,46 @@ Filter expressions are applicable to fields of the following types:
- Numeric
- Boolean: either **true** or **false**
- Strings. Enumerated values are a special case of this.
-- Date-time. In V3, all date time values are in ISO-8601 format, as specified in
- [RFC 3339 - Date and Time on the Internet: Timestamps](https://tools.ietf.org/html/rfc3339).
+- Date-time. In V3, all date time values are in ISO-8601 format, as specified in [RFC 3339 - Date and Time on the Internet: Timestamps](https://tools.ietf.org/html/rfc3339).
### Filter Syntax
-The V3 filter syntax is similar to, but not exactly the same as, that specified
-by the SCIM standard. These are some key differences:
+The V3 filter syntax is similar to, but not exactly the same as, that specified by the SCIM standard. These are some key differences:
- A slightly different set of supported operators
-- Case-sensitivity of operators. All V3 filter operators are in lowercase;
- specifying "EQ" instead of "eq" is not allowed.
+- Case-sensitivity of operators. All V3 filter operators are in lowercase; specifying "EQ" instead of "eq" is not allowed.
### Primitive Operators
These filter operators apply directly to fields and their values:
-| Operator | Description | Example |
-| -------- | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
-| `ca` | True if the collection-valued field contains all the listed values. | groups ca ("Venezia","Firenze") |
-| `co` | True if the value of the field contains the specified value as a substring.(Applicable to string-valued fields only.) | name co "Rajesh" |
-| `eq` | True if the value of the field indicated by the first operand is equal to the value specified by the second operand. | identitySummary.id eq "2c9180846e85e4b8016eafeba20c1314" |
-| `ge` | True if the value of the field indicated by the first operand is greater or equal to the value specified by the second operand. | daysUntilEscalation ge 7 name ge "Genaro" |
-| `gt` | True if the value of the field indicated by the first operand is greater than the value specified by the second operand. | daysUntilEscalation gt 7 name gt "Genaro" created gt 2018-12-18T23:05:55Z |
-| `in` | True if the field value is in the list of values. | accountActivityItemId in ("2c9180846b0a0583016b299f210c1314","2c9180846b0a0581016b299e82560c1314") |
-| `le` | True if the value of the field indicated by the first operand is less or equal to the value specified by the second operand. | daysUntilEscalation le 7 name le "Genaro" |
-| `lt` | True if the value of the field indicated by the first operand is less than the value specified by the second operand. | daysUntilEscalation lt 7 name lt "Genaro" created lt 2018-12-18T23:05:55Z |
-| `ne` | True if the value of the field indicated by the first operand is not equal to the value specified by the second operand. | type ne "ROLE" |
-| `pr` | True if the field is present, that is, not null. | pr accountRequestInfo |
-| `sw` | True if the value of the field starts with the specified value.(Applicable to string-valued fields only.) | name sw "Rajesh" |
+| Operator | Description | Example |
+| --- | --- | --- |
+| `ca` | True if the collection-valued field contains all the listed values. | groups ca ("Venezia","Firenze") |
+| `co` | True if the value of the field contains the specified value as a substring.(Applicable to string-valued fields only.) | name co "Rajesh" |
+| `eq` | True if the value of the field indicated by the first operand is equal to the value specified by the second operand. | identitySummary.id eq "2c9180846e85e4b8016eafeba20c1314" |
+| `ge` | True if the value of the field indicated by the first operand is greater or equal to the value specified by the second operand. | daysUntilEscalation ge 7 name ge "Genaro" |
+| `gt` | True if the value of the field indicated by the first operand is greater than the value specified by the second operand. | daysUntilEscalation gt 7 name gt "Genaro" created gt 2018-12-18T23:05:55Z |
+| `in` | True if the field value is in the list of values. | accountActivityItemId in ("2c9180846b0a0583016b299f210c1314","2c9180846b0a0581016b299e82560c1314") |
+| `le` | True if the value of the field indicated by the first operand is less or equal to the value specified by the second operand. | daysUntilEscalation le 7 name le "Genaro" |
+| `lt` | True if the value of the field indicated by the first operand is less than the value specified by the second operand. | daysUntilEscalation lt 7 name lt "Genaro" created lt 2018-12-18T23:05:55Z |
+| `ne` | True if the value of the field indicated by the first operand is not equal to the value specified by the second operand. | type ne "ROLE" |
+| `pr` | True if the field is present, that is, not null. | pr accountRequestInfo |
+| `sw` | True if the value of the field starts with the specified value.(Applicable to string-valued fields only.) | name sw "Rajesh" |
### Composite Operators
These operators are applied to other filter expressions:
-| Operator | Description | Example |
-| -------- | ------------------------------------------------------ | -------------------------------------- |
-| `and` | True if both the filter-valued operands are true. | startDate gt 2018 and name sw "Genaro" |
-| `not` | True if the filter-valued operand is false. | not groups ca ("Venezia","Firenze") |
-| `or` | True if either of the filter-valued operands are true. | startDate gt 2018 or name sw "Genaro" |
+| Operator | Description | Example |
+| --- | --- | --- |
+| `and` | True if both the filter-valued operands are true. | startDate gt 2018 and name sw "Genaro" |
+| `not` | True if the filter-valued operand is false. | not groups ca ("Venezia","Firenze") |
+| `or` | True if either of the filter-valued operands are true. | startDate gt 2018 or name sw "Genaro" |
### Escaping Special Characters in a Filter
-Certain characters must be escaped before they can be used in a filter
-expression. For example, the following filter expression attempting to find all
-sources with the name `#Employees` will produce a 400 error:
+Certain characters must be escaped before they can be used in a filter expression. For example, the following filter expression attempting to find all sources with the name `#Employees` will produce a 400 error:
`/v3/sources?filters=name eq "#Employees"`
@@ -103,13 +90,11 @@ To properly escape this filter, do the following:
`/v3/sources?filters=name eq "%23Employees"`
-If you are searching for a string containing double quotes, use the following
-escape sequence:
+If you are searching for a string containing double quotes, use the following escape sequence:
`/v3/sources/?filters=name eq "\"Employees\""`
-The following table lists the special characters that are incompatible with
-`filters` and how to escape them.
+The following table lists the special characters that are incompatible with `filters` and how to escape them.
| Character | Escape Sequence |
| --------- | --------------- |
@@ -121,68 +106,38 @@ The following table lists the special characters that are incompatible with
### Known Limitations
-Although filter expressions are a very general mechanism, individual API
-endpoints will only support filtering on a specific set of fields that are
-relevant to that endpoint, and will frequently only support a subset of
-operations for each field. For example, an endpoint might allow filtering on the
-name field but not support use of the co operator on that field. Consult the
-documentation for each API endpoint to determine what fields and operators can
-be used. Attempts to use an unsupported filter expression will result in a 400
-Bad Request response.
+Although filter expressions are a very general mechanism, individual API endpoints will only support filtering on a specific set of fields that are relevant to that endpoint, and will frequently only support a subset of operations for each field. For example, an endpoint might allow filtering on the name field but not support use of the co operator on that field. Consult the documentation for each API endpoint to determine what fields and operators can be used. Attempts to use an unsupported filter expression will result in a 400 Bad Request response.
Examples:
- `/v3/public-identities?filters=email eq "john.doe@example.com"`
- `/v3/public-identities?filters=firstname sw "john" or email sw "joe"`
-- `not prop1 eq val1 or prop2 eq val2 and prop3 eq val3` is equivalent to
- `(not (prop1 eq val1)) or ((prop2 eq val2) and (prop3 eq val3))`
-- `not (prop1 eq val1 or prop2 eq val2) and prop3 eq val3` is equivalent to
- `(not ((prop1 eq val1) or (prop2 eq val2))) and (prop3 eq val3)`
+- `not prop1 eq val1 or prop2 eq val2 and prop3 eq val3` is equivalent to `(not (prop1 eq val1)) or ((prop2 eq val2) and (prop3 eq val3))`
+- `not (prop1 eq val1 or prop2 eq val2) and prop3 eq val3` is equivalent to `(not ((prop1 eq val1) or (prop2 eq val2))) and (prop3 eq val3)`
:::info
-- Spaces in URLs must be escaped with `%20`. Most programming languages,
- frameworks, libraries, and tools will do this for you, but some won't. In the
- event that your tool doesn't escape spaces, you will need to format your query
- as `/v3/public-identities?filters=email%20eq%20"john.doe@example.com"`
+- Spaces in URLs must be escaped with `%20`. Most programming languages, frameworks, libraries, and tools will do this for you, but some won't. In the event that your tool doesn't escape spaces, you will need to format your query as `/v3/public-identities?filters=email%20eq%20"john.doe@example.com"`
-- You must escape spaces in URLs with `%20`. Most programming languages,
- frameworks, libraries, and tools do this for you, but some do not. In the
- event that your tool does not escape spaces, you must format your query as
- `/v3/public-identities?filters=email%20eq%20"john.doe@example.com"`
+- You must escape spaces in URLs with `%20`. Most programming languages, frameworks, libraries, and tools do this for you, but some do not. In the event that your tool does not escape spaces, you must format your query as `/v3/public-identities?filters=email%20eq%20"john.doe@example.com"`
-- Unless explicitly noted otherwise, strings are compared lexicographically.
- Most comparisons are not case sensitive. Any situations where the comparisons
- are case sensitive will be called out.
+- Unless explicitly noted otherwise, strings are compared lexicographically. Most comparisons are not case sensitive. Any situations where the comparisons are case sensitive will be called out.
-- Date-times are compared temporally; an earlier date-time is less than a later
- date-time.
+- Date-times are compared temporally; an earlier date-time is less than a later date-time.
-- The usual precedence and associativity of the composite operators applies,
- with **not** having higher priority than **and**, which in turn has higher
- priority than **or**. You can use parentheses to override this precedence.
+- The usual precedence and associativity of the composite operators applies, with **not** having higher priority than **and**, which in turn has higher priority than **or**. You can use parentheses to override this precedence.
:::
### Sorting Results
-Result sorting is supported with the standard `sorters` parameter. Its syntax is
-a set of comma-separated field names. You may optionally prefix each field name
-with a "-" character, indicating that the sort is descending based on the value
-of that field. Otherwise, the sort is ascending.
+Result sorting is supported with the standard `sorters` parameter. Its syntax is a set of comma-separated field names. You may optionally prefix each field name with a "-" character, indicating that the sort is descending based on the value of that field. Otherwise, the sort is ascending.
-For example, to sort primarily by **type** in ascending order, and secondarily
-by **modified date** in descending order, use `sorters=type,-modified`
+For example, to sort primarily by **type** in ascending order, and secondarily by **modified date** in descending order, use `sorters=type,-modified`
## Putting it all Together
-Pagination, filters, and sorters can be mixed and match to achieve the desired
-output for a given collection endpoint. Here are some examples:
+Pagination, filters, and sorters can be mixed and match to achieve the desired output for a given collection endpoint. Here are some examples:
-- `/v3/public-identities?limit=20&filters=firstname eq "john"&sorters=-name`
- returns the first 20 identities that have a first name of John and are sorted
- in descending order by full name.
-- `/v3/account-activities?limit=10&offset=2&sorters=-created` sorts the results
- by descending created time, so the most recent activities appear first. The
- limit and offset returns the 3rd page of this sorted response with 10 records
- displayed.
+- `/v3/public-identities?limit=20&filters=firstname eq "john"&sorters=-name` returns the first 20 identities that have a first name of John and are sorted in descending order by full name.
+- `/v3/account-activities?limit=10&offset=2&sorters=-created` sorts the results by descending created time, so the most recent activities appear first. The limit and offset returns the 3rd page of this sorted response with 10 records displayed.
diff --git a/products/idn/docs/identity-now/event-triggers/available/access-request-dynamic-approval.md b/products/idn/docs/identity-now/event-triggers/available/access-request-dynamic-approval.md
index f80db54fd..a1b771403 100644
--- a/products/idn/docs/identity-now/event-triggers/available/access-request-dynamic-approval.md
+++ b/products/idn/docs/identity-now/event-triggers/available/access-request-dynamic-approval.md
@@ -5,37 +5,25 @@ pagination_label: Access Request Dynamic Approval
sidebar_label: Access Request Dynamic Approval
sidebar_class_name: accessRequestDynamicApproval
keywords:
- ["event", "trigger", "access", "request", "dynamic", "approval", "available"]
+ ['event', 'trigger', 'access', 'request', 'dynamic', 'approval', 'available']
description: Fires after an access request is submitted.
slug: /docs/event-triggers/triggers/access-request-dynamic-approval
-tags: ["Event Triggers", "Available Event Triggers", "Request Response"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Request Response']
---
## Event Context
-The Access Request Dynamic Approval event trigger provides a way to route a
-request to an additional approval step by an identity or a governance group.
+The Access Request Dynamic Approval event trigger provides a way to route a request to an additional approval step by an identity or a governance group.
-When an access request is submitted, the Access Request Dynamic Approval trigger
-does the following:
+When an access request is submitted, the Access Request Dynamic Approval trigger does the following:
-- Sends data about the access request and expects a response including the ID of
- an existing identity or workgroup (i.e. governance group) to add to the
- approval workflow.
-- Based on the ID received, an approval task is assigned to the identity or
- governance group in IdentityNow for a decision as an additional step after
- other configured approval requirements are met.
-- If the new approver is also the target identity for this request, the manager
- is assigned instead. If the identity has no manager, a random org admin is
- assigned.
-- If the ID of the additional approver is wrong, then a random org admin is
- assigned.
-- You can choose to **NOT** add an additional approver by providing an empty
- object as the response to the triggered REST request.
+- Sends data about the access request and expects a response including the ID of an existing identity or workgroup (i.e. governance group) to add to the approval workflow.
+- Based on the ID received, an approval task is assigned to the identity or governance group in IdentityNow for a decision as an additional step after other configured approval requirements are met.
+- If the new approver is also the target identity for this request, the manager is assigned instead. If the identity has no manager, a random org admin is assigned.
+- If the ID of the additional approver is wrong, then a random org admin is assigned.
+- You can choose to **NOT** add an additional approver by providing an empty object as the response to the triggered REST request.
-You can use this trigger to develop logic outside of IdentityNow’s
-out-of-the-box offerings to route an approval step to users such as the
-following:
+You can use this trigger to develop logic outside of IdentityNow’s out-of-the-box offerings to route an approval step to users such as the following:
- The recipient’s department head
- The recipient’s cost center
@@ -44,15 +32,9 @@ following:
## Configuration
-This is a `REQUEST_RESPONSE` trigger type. For more information about how to
-respond to a `REQUEST_RESPONSE` type trigger, see
-[responding to a request response type trigger](../responding-to-a-request-response-trigger.mdx)
-. This trigger intercepts newly submitted access requests and allows the
-subscribing service to add one additional identity or governance group as the
-last step in the approver list for the access request.
+This is a `REQUEST_RESPONSE` trigger type. For more information about how to respond to a `REQUEST_RESPONSE` type trigger, see [responding to a request response type trigger](../responding-to-a-request-response-trigger.mdx) . This trigger intercepts newly submitted access requests and allows the subscribing service to add one additional identity or governance group as the last step in the approver list for the access request.
-The subscribing service will receive the following input from the trigger
-service.
+The subscribing service will receive the following input from the trigger service.
@@ -82,13 +64,11 @@ service.
}
```
-The subscribing service can use this information to make a decision about
-whether to add additional approvers to the access request.
+The subscribing service can use this information to make a decision about whether to add additional approvers to the access request.
-To add an identity to the approver list, the subscribing service responds to the
-event trigger with the following payload:
+To add an identity to the approver list, the subscribing service responds to the event trigger with the following payload:
```json
{
@@ -98,8 +78,7 @@ event trigger with the following payload:
}
```
-To add a governance group to the approver list, the subscribing service responds
-to the event trigger with the following payload:
+To add a governance group to the approver list, the subscribing service responds to the event trigger with the following payload:
```json
{
@@ -109,8 +88,7 @@ to the event trigger with the following payload:
}
```
-If no identity or group should be added to a particular access request, then the
-subscribing service responds with the following object:
+If no identity or group should be added to a particular access request, then the subscribing service responds with the following object:
```json
{
diff --git a/products/idn/docs/identity-now/event-triggers/available/access-request-postapproval.md b/products/idn/docs/identity-now/event-triggers/available/access-request-postapproval.md
index e01d68306..9a0ce1136 100644
--- a/products/idn/docs/identity-now/event-triggers/available/access-request-postapproval.md
+++ b/products/idn/docs/identity-now/event-triggers/available/access-request-postapproval.md
@@ -6,41 +6,33 @@ sidebar_label: Access Request Postapproval
sidebar_class_name: accessRequestPostapproval
keywords:
[
- "event",
- "trigger",
- "access",
- "request",
- "postapproval",
- "post",
- "approval",
- "available",
+ 'event',
+ 'trigger',
+ 'access',
+ 'request',
+ 'postapproval',
+ 'post',
+ 'approval',
+ 'available',
]
description: Fires after an access request is approved.
slug: /docs/event-triggers/triggers/access-request-postapproval
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context
-The SailPoint IdentityNow platform now includes event triggers within the Access
-Request Approval workflow. The Access Request Postapproval event trigger
-provides more proactive governance and ensures users can quickly obtain needed
-access.
+The SailPoint IdentityNow platform now includes event triggers within the Access Request Approval workflow. The Access Request Postapproval event trigger provides more proactive governance and ensures users can quickly obtain needed access.

-When an access request is approved, some uses cases for this trigger include the
-following:
+When an access request is approved, some uses cases for this trigger include the following:
- Notify the requester that the access request has been approved or denied.
-- Notify the administrator or system to take the appropriate provisioning
- actions for the requested access.
-- Notify a third party system to trigger another action (e.g. customer feedback
- survey, initiate another business process), or it can be used for auditing
- once an access request decision has been made.
+- Notify the administrator or system to take the appropriate provisioning actions for the requested access.
+- Notify a third party system to trigger another action (e.g. customer feedback survey, initiate another business process), or it can be used for auditing once an access request decision has been made.
-The Access Request event trigger is a flexible way to extend the Access Request
-workflow after access is approved for the requester.
+The Access Request event trigger is a flexible way to extend the Access Request workflow after access is approved for the requester.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/available/access-request-preapproval.md b/products/idn/docs/identity-now/event-triggers/available/access-request-preapproval.md
index cddae0e30..c13eec74c 100644
--- a/products/idn/docs/identity-now/event-triggers/available/access-request-preapproval.md
+++ b/products/idn/docs/identity-now/event-triggers/available/access-request-preapproval.md
@@ -4,52 +4,36 @@ title: Access Request Preapproval
pagination_label: Access Request Preapproval
sidebar_label: Access Request Preapproval
sidebar_class_name: accessRequestPreapproval
-keywords: ["event", "trigger", "access", "request", "preapproval", "available"]
+keywords: ['event', 'trigger', 'access', 'request', 'preapproval', 'available']
description: Fires after an access request is submitted.
slug: /docs/event-triggers/triggers/access-request-preapproval
-tags: ["Event Triggers", "Available Event Triggers", "Request Response"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Request Response']
---
## Event Context
-The platform now includes event triggers within the Access Request approval
-workflow. The Access Request Submitted event trigger provides more proactive
-governance, ensures users can quickly obtain needed access, and helps with more
-preventative measures towards unintended access.
+The platform now includes event triggers within the Access Request approval workflow. The Access Request Submitted event trigger provides more proactive governance, ensures users can quickly obtain needed access, and helps with more preventative measures towards unintended access.

-When an access request is submitted, some uses cases for this trigger include
-the following:
+When an access request is submitted, some uses cases for this trigger include the following:
-- Provide the approver with additional context about the access request, like
- any Separation of Duties (SOD) policy violations, for example.
-- Notify the approver through a different medium, such as Slack or Outlook
- Actionable Messages.
-- Send a Terms of Agreement form of the requested Application to be signed by
- the access requester.
-- On average, you can expect about 1 access request for every 4 identities
- within your org per day. On average you can expect about 1 to 2 access
- requests within a 10 second period.
+- Provide the approver with additional context about the access request, like any Separation of Duties (SOD) policy violations, for example.
+- Notify the approver through a different medium, such as Slack or Outlook Actionable Messages.
+- Send a Terms of Agreement form of the requested Application to be signed by the access requester.
+- On average, you can expect about 1 access request for every 4 identities within your org per day. On average you can expect about 1 to 2 access requests within a 10 second period.
Additional use cases include the following:
-- Send a Slack Notification to the approver or an approval channel and approve
- the request within Slack.
+- Send a Slack Notification to the approver or an approval channel and approve the request within Slack.
- Create an Outlook Actionable Message.
- Create a Google Doc for the requester to fill out and submit.
## Configuration
-This is a `REQUEST_RESPONSE` trigger type. For more information about how to
-respond to a `REQUEST_RESPONSE` type trigger, see
-[responding to a request response type trigger](../responding-to-a-request-response-trigger.mdx).
-This trigger intercepts newly submitted access requests and allows the
-subscribing service to perform a preliminary approval/denial before the access
-request moves to the next approver in the chain.
+This is a `REQUEST_RESPONSE` trigger type. For more information about how to respond to a `REQUEST_RESPONSE` type trigger, see [responding to a request response type trigger](../responding-to-a-request-response-trigger.mdx). This trigger intercepts newly submitted access requests and allows the subscribing service to perform a preliminary approval/denial before the access request moves to the next approver in the chain.
-The subscribing service will receive the following input from the trigger
-service.
+The subscribing service will receive the following input from the trigger service.
@@ -79,13 +63,11 @@ service.
}
```
-The subscribing service can use this information to make a decision about
-whether to approve or deny the request.
+The subscribing service can use this information to make a decision about whether to approve or deny the request.
-To approve an access request, the subscribing service responds to the event
-trigger with the following payload:
+To approve an access request, the subscribing service responds to the event trigger with the following payload:
```json
{
@@ -95,8 +77,7 @@ trigger with the following payload:
}
```
-To deny an access request, the subscribing service responds to the event trigger
-with the following payload:
+To deny an access request, the subscribing service responds to the event trigger with the following payload:
```json
{
@@ -106,12 +87,7 @@ with the following payload:
}
```
-This event trigger interrupts the normal workflow for access requests. Access
-requests can only proceed if the subscribing service responds within the alotted
-time by approving the request. If the subscribing service is non-responsive or
-it is responding with an incorrect payload, access requests will fail after the
-**Separation of Duties** check. If you see numerous access requests failing at
-this stage, verify that your subscribing service itself is operating correctly.
+This event trigger interrupts the normal workflow for access requests. Access requests can only proceed if the subscribing service responds within the alotted time by approving the request. If the subscribing service is non-responsive or it is responding with an incorrect payload, access requests will fail after the **Separation of Duties** check. If you see numerous access requests failing at this stage, verify that your subscribing service itself is operating correctly.

diff --git a/products/idn/docs/identity-now/event-triggers/available/account-aggregation-completed.md b/products/idn/docs/identity-now/event-triggers/available/account-aggregation-completed.md
index 72579bc87..fab67236d 100644
--- a/products/idn/docs/identity-now/event-triggers/available/account-aggregation-completed.md
+++ b/products/idn/docs/identity-now/event-triggers/available/account-aggregation-completed.md
@@ -5,35 +5,23 @@ pagination_label: Account Aggregation Completed
sidebar_label: Account Aggregation Completed
sidebar_class_name: accountAggregationCompleted
keywords:
- ["event", "trigger", "account", "aggregation", "completed", "available"]
+ ['event', 'trigger', 'account', 'aggregation', 'completed', 'available']
description: Fires after an account aggregation completed, terminated, or failed.
slug: /docs/event-triggers/triggers/account-aggregation-completed
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context
-The platform has introduced an event trigger within the Source Aggregation
-workflow to provide additional monitoring capabilities. This trigger helps
-ensure account aggregations are performing as expected and identity data always
-reflects current source account information for better identity governance.
-Aggregations connect to a source and collect account information from the source
-to discover the number of accounts that have been added, changed, or removed.
-For more information about account aggregation see
-[Account Aggregation Data flow](https://community.sailpoint.com/t5/Technical-White-Papers/Account-Aggregation-Data-Flow/ta-p/79914#toc-hId-1367430234)
+The platform has introduced an event trigger within the Source Aggregation workflow to provide additional monitoring capabilities. This trigger helps ensure account aggregations are performing as expected and identity data always reflects current source account information for better identity governance. Aggregations connect to a source and collect account information from the source to discover the number of accounts that have been added, changed, or removed. For more information about account aggregation see [Account Aggregation Data flow](https://community.sailpoint.com/t5/Technical-White-Papers/Account-Aggregation-Data-Flow/ta-p/79914#toc-hId-1367430234)

-After the initial collection of accounts in the source system during aggregation
-completes, some uses cases for this trigger include the following:
+After the initial collection of accounts in the source system during aggregation completes, some uses cases for this trigger include the following:
-- Notify an administrator that IdentityNow was able to successfully connect to
- the source system and collect source accounts.
-- Notify an administrator when the aggregation is terminated manually during the
- account collection phase.
-- Notify an administrator or system (e.g. PagerDuty) that IdentityNow failed to
- collect accounts during aggregation and indicate required remediation for the
- source system.
+- Notify an administrator that IdentityNow was able to successfully connect to the source system and collect source accounts.
+- Notify an administrator when the aggregation is terminated manually during the account collection phase.
+- Notify an administrator or system (e.g. PagerDuty) that IdentityNow failed to collect accounts during aggregation and indicate required remediation for the source system.
:::info
@@ -77,28 +65,15 @@ The source account activity is summarized in `stats`, as seen in this example:
}
```
-In this example, there are 10 changed accounts (`scanned` (200) - `unchanged` -
-(190)). Changed accounts include accounts that are `added` (6) and accounts that
-are `changed` (4), equaling 10 accounts. Removed accounts may or may not be
-included in the changed account total depending on the sources. For this
-example, `removed` (3) may be considered a changed account in some sources and
-would show a `scanned` count of 203 instead of 200.
+In this example, there are 10 changed accounts (`scanned` (200) - `unchanged` - (190)). Changed accounts include accounts that are `added` (6) and accounts that are `changed` (4), equaling 10 accounts. Removed accounts may or may not be included in the changed account total depending on the sources. For this example, `removed` (3) may be considered a changed account in some sources and would show a `scanned` count of 203 instead of 200.
-> This event trigger fires even without changed accounts. The unchanged count
-> will match the scanned accounts in the response.
+> This event trigger fires even without changed accounts. The unchanged count will match the scanned accounts in the response.
The status of the aggregation can be one of three possible values:
-- **Success**: Account collection was successful and aggregation can move to the
- next step.
-- **Error**: There is a failure in account collection or an issue connecting to
- the source. The `errors` vary by source.
-- **Termination**: The aggregation was terminated during the account collection
- phase. Aggregation can be terminated when the account deletion threshold is
- exceeded. For example, an account delete threshold of 10% is set by default
- for the source, and if the number of `removed` accounts for the above example
- is 21 (more than 10% of `scanned` accounts (200)), the aggregation is
- cancelled.
+- **Success**: Account collection was successful and aggregation can move to the next step.
+- **Error**: There is a failure in account collection or an issue connecting to the source. The `errors` vary by source.
+- **Termination**: The aggregation was terminated during the account collection phase. Aggregation can be terminated when the account deletion threshold is exceeded. For example, an account delete threshold of 10% is set by default for the source, and if the number of `removed` accounts for the above example is 21 (more than 10% of `scanned` accounts (200)), the aggregation is cancelled.

diff --git a/products/idn/docs/identity-now/event-triggers/available/identity-attribute-changed.md b/products/idn/docs/identity-now/event-triggers/available/identity-attribute-changed.md
index 8ce2da537..f6f234ab4 100644
--- a/products/idn/docs/identity-now/event-triggers/available/identity-attribute-changed.md
+++ b/products/idn/docs/identity-now/event-triggers/available/identity-attribute-changed.md
@@ -4,32 +4,24 @@ title: Identity Attributes Changed
pagination_label: Identity Attributes Changed
sidebar_label: Identity Attributes Changed
sidebar_class_name: identityAttributesChanged
-keywords: ["event", "trigger", "identity", "attributes", "changed", "available"]
+keywords: ['event', 'trigger', 'identity', 'attributes', 'changed', 'available']
description: Fires after one or more identity attributes changed.
slug: /docs/event-triggers/triggers/identity-attribute-changed
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context

-Identity Attribute Changed events occur when any attributes aggegrated from an
-authoritative source differ from the current attributes for an identity during
-an identity refresh. See
-[Configuring Correlation](https://community.sailpoint.com/t5/Connectors/Configuring-Correlation/ta-p/74045)
-for more information.
+Identity Attribute Changed events occur when any attributes aggegrated from an authoritative source differ from the current attributes for an identity during an identity refresh. See [Configuring Correlation](https://community.sailpoint.com/t5/Connectors/Configuring-Correlation/ta-p/74045) for more information.
-This event trigger provides a flexible way to extend Joiner-Mover-Leaver
-processes. This provides more proactive governance and ensures users can quickly
-get necessary access when they enter your organization.
+This event trigger provides a flexible way to extend Joiner-Mover-Leaver processes. This provides more proactive governance and ensures users can quickly get necessary access when they enter your organization.
Some uses cases for this trigger include the following:
-- Notify an administrator or system to take the appropriate provisioning actions
- as part of the Mover workflow.
-- Notify a system to trigger another action, like triggering a certification
- campaign when an identity's manager changes, for example.
+- Notify an administrator or system to take the appropriate provisioning actions as part of the Mover workflow.
+- Notify a system to trigger another action, like triggering a certification campaign when an identity's manager changes, for example.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/available/identity-created.md b/products/idn/docs/identity-now/event-triggers/available/identity-created.md
index f883246b3..64134b661 100644
--- a/products/idn/docs/identity-now/event-triggers/available/identity-created.md
+++ b/products/idn/docs/identity-now/event-triggers/available/identity-created.md
@@ -4,35 +4,24 @@ title: Identity Created
pagination_label: Identity Created
sidebar_label: Identity Created
sidebar_class_name: identityCreated
-keywords: ["event", "trigger", "identity", "created", "available"]
+keywords: ['event', 'trigger', 'identity', 'created', 'available']
description: Fires after an identity is created.
slug: /docs/event-triggers/triggers/identity-created
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context

-Identity Created events occur when a new identity is detected during an
-aggregration and refresh from an authoritative source. New identities are
-detected when an account from the authoritative source is not correlated to an
-existing identity. For more information, see
-[Configuring Correlation](https://community.sailpoint.com/t5/Connectors/Configuring-Correlation/ta-p/74045).
-The Identity Created event contains all of the identity attributes as they are
-configured in the identity profile. For more information, see
-[Mapping Identity Profiles](https://community.sailpoint.com/t5/Admin-Help/Mapping-Identity-Profiles/ta-p/77877).
+Identity Created events occur when a new identity is detected during an aggregration and refresh from an authoritative source. New identities are detected when an account from the authoritative source is not correlated to an existing identity. For more information, see [Configuring Correlation](https://community.sailpoint.com/t5/Connectors/Configuring-Correlation/ta-p/74045). The Identity Created event contains all of the identity attributes as they are configured in the identity profile. For more information, see [Mapping Identity Profiles](https://community.sailpoint.com/t5/Admin-Help/Mapping-Identity-Profiles/ta-p/77877).
-This event trigger provides a flexible way to extend Joiner-Mover-Leaver
-processes. This provides more proactive governance and ensures users can quickly
-get necessary access when they enter your organization.
+This event trigger provides a flexible way to extend Joiner-Mover-Leaver processes. This provides more proactive governance and ensures users can quickly get necessary access when they enter your organization.
Some uses cases for this trigger include the following:
-- Notify an administrator or system to take the appropriate birthright
- provisioning actions as part of the Joiner workflow.
-- Notify a third party system to trigger another action (e.g. create an
- onboarding experience for a new hire).
+- Notify an administrator or system to take the appropriate birthright provisioning actions as part of the Joiner workflow.
+- Notify a third party system to trigger another action (e.g. create an onboarding experience for a new hire).
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/available/index.mdx b/products/idn/docs/identity-now/event-triggers/available/index.mdx
index 9e9cf0d80..5ce153d65 100644
--- a/products/idn/docs/identity-now/event-triggers/available/index.mdx
+++ b/products/idn/docs/identity-now/event-triggers/available/index.mdx
@@ -4,19 +4,16 @@ title: Available Event Triggers
pagination_label: Available Event Triggers
sidebar_label: Available Event Triggers
sidebar_class_name: availableEventTriggers
-keywords: ["event", "trigger", "available"]
+keywords: ['event', 'trigger', 'available']
description: Event triggers that are generally available.
sidebar_position: 7
slug: /docs/event-triggers/available
-tags: ["Event Triggers", "Available Event Triggers"]
+tags: ['Event Triggers', 'Available Event Triggers']
---
-import DocCardList from "@theme/DocCardList";
-import { useCurrentSidebarCategory } from "@docusaurus/theme-common";
+import DocCardList from '@theme/DocCardList';
+import {useCurrentSidebarCategory} from '@docusaurus/theme-common';
-The event triggers in this section are generally available to all IDN tenants.
-Event triggers currently in development are considered
-[Early Access](../early-access/index.mdx) and require a support ticket to be
-enabled in a tenant.
+The event triggers in this section are generally available to all IDN tenants. Event triggers currently in development are considered [Early Access](../early-access/index.mdx) and require a support ticket to be enabled in a tenant.
diff --git a/products/idn/docs/identity-now/event-triggers/available/provisioning-action-completed.md b/products/idn/docs/identity-now/event-triggers/available/provisioning-action-completed.md
index c22295ef0..fad866731 100644
--- a/products/idn/docs/identity-now/event-triggers/available/provisioning-action-completed.md
+++ b/products/idn/docs/identity-now/event-triggers/available/provisioning-action-completed.md
@@ -5,31 +5,24 @@ pagination_label: Provisioning Action Completed
sidebar_label: Provisioning Action Completed
sidebar_class_name: provisioningActionCompleted
keywords:
- ["event", "trigger", "provisioning", "action", "completed", "available"]
+ ['event', 'trigger', 'provisioning', 'action', 'completed', 'available']
description: Fires after a provisioning action completed on a source.
slug: /docs/event-triggers/triggers/provisioning-action-completed
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context

-The Provisioning Action Completed event trigger notifies subscribed applications
-after the action is completed. This event trigger provides a flexible way to
-extend the Provisioning workflow after access has changed for an identity within
-SailPoint. This provides more proactive governance and ensures users can quickly
-get necessary access.
+The Provisioning Action Completed event trigger notifies subscribed applications after the action is completed. This event trigger provides a flexible way to extend the Provisioning workflow after access has changed for an identity within SailPoint. This provides more proactive governance and ensures users can quickly get necessary access.
Some uses cases for this trigger include the following:
- Notify the requester that the access request has been fulfilled.
-- Notify an application user and/or access certifier that access has been
- revoked.
+- Notify an application user and/or access certifier that access has been revoked.
- Notify an administrator or system that provisioning has been completed.
-- Notify a third party system to trigger another action, like continuing
- additional provisioning actions or auditing of provisioning activities, for
- example.
+- Notify a third party system to trigger another action, like continuing additional provisioning actions or auditing of provisioning activities, for example.
This is an example input from this trigger:
@@ -79,26 +72,20 @@ This is an example input from this trigger:
Before consuming this event trigger, the following prerequesites must be met:
- An oAuth Client configured with authority as `ORG_ADMIN`.
-- An org enabled with the `ARSENAL_ALLOW_POSTPROVISIONING_TRIGGERS` feature
- flag.
+- An org enabled with the `ARSENAL_ALLOW_POSTPROVISIONING_TRIGGERS` feature flag.
- Configure connectors for provisioning into target applications.
-- An org configured for automated provisioning. See the Event Context section
- for specific setup.
+- An org configured for automated provisioning. See the Event Context section for specific setup.
-To provision to a target application, the connector for the source must support
-the following connector features:
+To provision to a target application, the connector for the source must support the following connector features:
- `ENABLE` - Can enable or disable accounts.
- `UNLOCK` - Can lock or unlock accounts.
-- `PROVISIONING` - Can write to accounts. Currently, the trigger does not
- include attribute synchronization.
+- `PROVISIONING` - Can write to accounts. Currently, the trigger does not include attribute synchronization.
- `PASSWORD` - Can update password for accounts.
-For a list of supported connectors and features, see
-[Supported Connectors for IdentityNow](https://community.sailpoint.com/t5/Connectors/Supported-Sources-Connectors-for-IdentityNow/ta-p/80019).
+For a list of supported connectors and features, see [Supported Connectors for IdentityNow](https://community.sailpoint.com/t5/Connectors/Supported-Sources-Connectors-for-IdentityNow/ta-p/80019).
-For information about configuring sources for provisioning, see
-[How can I edit the Create Profile on a source?](https://community.sailpoint.com/t5/Connectors/How-can-I-edit-the-Create-Profile-on-a-source/ta-p/74429).
+For information about configuring sources for provisioning, see [How can I edit the Create Profile on a source?](https://community.sailpoint.com/t5/Connectors/How-can-I-edit-the-Create-Profile-on-a-source/ta-p/74429).
Provisioning events occur in these workflows:
@@ -110,46 +97,34 @@ Provisioning events occur in these workflows:
### Access Request
-When an Access Request approval process has completed with all positive
-approvals, the access request is fulfilled with provisioning to the target
-application with requested access.
+When an Access Request approval process has completed with all positive approvals, the access request is fulfilled with provisioning to the target application with requested access.

-Access acquired through a role request can also be revoked, and those changes
-can be provisioned to an account.
+Access acquired through a role request can also be revoked, and those changes can be provisioned to an account.
The following steps must be completed:
-- Source Connector configured for `PROVISIONING`. Access requests in SailPoint
- SaaS currently do not support `ACCOUNT_ONLY_REQUEST` or
- `ADDITIONAL_ACCOUNT_REQUEST`.
+- Source Connector configured for `PROVISIONING`. Access requests in SailPoint SaaS currently do not support `ACCOUNT_ONLY_REQUEST` or `ADDITIONAL_ACCOUNT_REQUEST`.
- Source entitlements mapped in Account Schema.
- Access profile using source entitlements. Role setup is optional.
- Application enabled for Access Request.
-> **NOTE:** There is no indication to the approver in the IdentityNow UI that
-> the approval is for a revoke action. This must be considered for all usage of
-> these APIs.
+> **NOTE:** There is no indication to the approver in the IdentityNow UI that the approval is for a revoke action. This must be considered for all usage of these APIs.

### Certification
-Provisioning removal of accounts acquired through Access Request occurs through
-certifications.
+Provisioning removal of accounts acquired through Access Request occurs through certifications.
-> **Note:** Certifications cannot revoke access acquired via role membership or
-> lifecycle Changes.
+> **Note:** Certifications cannot revoke access acquired via role membership or lifecycle Changes.

### Role Membership
-Access defined in access profiles can be grouped into roles, and roles can be
-assigned to identities using `COMPLEX_CRITERION` or `IDENTITY_LIST`. See
-[Admin UI](https://community.sailpoint.com/t5/Admin-Help/Standard-Role-Membership-Criteria-Options/ta-p/74392)
-for information on how to set `COMPLEX_CRITERION`.
+Access defined in access profiles can be grouped into roles, and roles can be assigned to identities using `COMPLEX_CRITERION` or `IDENTITY_LIST`. See [Admin UI](https://community.sailpoint.com/t5/Admin-Help/Standard-Role-Membership-Criteria-Options/ta-p/74392) for information on how to set `COMPLEX_CRITERION`.
> **Note:** `CUSTOM` role membership through rules is no longer supported.
@@ -165,8 +140,7 @@ This trigger fires when an account has been provisioned, enabled, or disabled.
To provision access with lifecycle states, the prerequisites must be met:
-- Source connector configured for `ENABLE` to enable/disable accounts and/or
- `PROVISIONING` to create/update/delete accounts.
+- Source connector configured for `ENABLE` to enable/disable accounts and/or `PROVISIONING` to create/update/delete accounts.
- Source entitlements mapped from an authoritative source.
- Source entitlements mapped to access profiles.
- Identity profile using an authoritative source.
@@ -174,14 +148,11 @@ To provision access with lifecycle states, the prerequisites must be met:
### Password Management
-Password changes can be provisioned to target applications through password
-reset or password interception. Also, unlocking of accounts can be provisioned
-via password change within SailPoint SaaS.
+Password changes can be provisioned to target applications through password reset or password interception. Also, unlocking of accounts can be provisioned via password change within SailPoint SaaS.
For password management setup, you must configure the following:
-- Source connector configured for `PASSWORD` for password changes and/or
- `UNLOCK` for unlocking changes.
+- Source connector configured for `PASSWORD` for password changes and/or `UNLOCK` for unlocking changes.
- Password sync group
## Additional Information and Links
diff --git a/products/idn/docs/identity-now/event-triggers/available/saved-search-completed.md b/products/idn/docs/identity-now/event-triggers/available/saved-search-completed.md
index ed3c6f7f9..e00a703d2 100644
--- a/products/idn/docs/identity-now/event-triggers/available/saved-search-completed.md
+++ b/products/idn/docs/identity-now/event-triggers/available/saved-search-completed.md
@@ -4,41 +4,26 @@ title: Saved Search Complete
pagination_label: Saved Search Complete
sidebar_label: Saved Search Complete
sidebar_class_name: savedSearchComplete
-keywords: ["event", "trigger", "saved", "search", "complete", "available"]
+keywords: ['event', 'trigger', 'saved', 'search', 'complete', 'available']
description: Fires after a scheduled search completed.
slug: /docs/event-triggers/triggers/saved-search-completed
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context

-Users can subscribe to Saved Searches and receive an email of a report generated
-from the saved search. For example, a user can save a search query called
-"Identities with upcoming end dates" and create a subscription to receive a
-daily report showing identities with an end date within 10 days from the current
-date. This event trigger can also notify an external HTTP application that a
-report generated from a saved search subscription is available to be processed.
+Users can subscribe to Saved Searches and receive an email of a report generated from the saved search. For example, a user can save a search query called "Identities with upcoming end dates" and create a subscription to receive a daily report showing identities with an end date within 10 days from the current date. This event trigger can also notify an external HTTP application that a report generated from a saved search subscription is available to be processed.
-Saved Search Completed events occur based on the schedules set for saved search
-subscriptions. For example, if you have a scheduled saved search for Monday,
-Tuesday, Wednesday, Thursday, Friday at 6:00 GMT, your HTTP endpoint will also
-receive a notification at those times. This can be set using the `schedule`
-object in the
-[create scheduled search endpoint](/idn/api/v3/scheduled-search-create).
+Saved Search Completed events occur based on the schedules set for saved search subscriptions. For example, if you have a scheduled saved search for Monday, Tuesday, Wednesday, Thursday, Friday at 6:00 GMT, your HTTP endpoint will also receive a notification at those times. This can be set using the `schedule` object in the [create scheduled search endpoint](/idn/api/v3/scheduled-search-create).
-To receive this event when a saved search query does not have any results, set
-`emailEmptyResults` to `TRUE`. You can also set the expiration date in the
-`expiration` field within the `schedule` object. Your HTTP endpoint will stop
-receiving these events when the scheduled search expires.
+To receive this event when a saved search query does not have any results, set `emailEmptyResults` to `TRUE`. You can also set the expiration date in the `expiration` field within the `schedule` object. Your HTTP endpoint will stop receiving these events when the scheduled search expires.
Some uses cases for this trigger include the following:
-- Perform quality control, such as continuously checking for Separation of
- Duties (SOD) violations.
-- Respond to upcoming joiner-mover-leaver scenarios, such as deprovisioning
- access before an employee's separation date.
+- Perform quality control, such as continuously checking for Separation of Duties (SOD) violations.
+- Respond to upcoming joiner-mover-leaver scenarios, such as deprovisioning access before an employee's separation date.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/available/source-created.md b/products/idn/docs/identity-now/event-triggers/available/source-created.md
index d47beec48..e584613ad 100644
--- a/products/idn/docs/identity-now/event-triggers/available/source-created.md
+++ b/products/idn/docs/identity-now/event-triggers/available/source-created.md
@@ -4,19 +4,17 @@ title: Source Created
pagination_label: Source Created
sidebar_label: Source Created
sidebar_class_name: sourceCreated
-keywords: ["event", "trigger", "source", "created", "available"]
+keywords: ['event', 'trigger', 'source', 'created', 'available']
description: Fires after a source is created.
slug: /docs/event-triggers/triggers/source-created
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context
-Source Created events occur when a new source is successfully created via the
-API or the Admin UI. Some uses cases for this trigger include the following:
+Source Created events occur when a new source is successfully created via the API or the Admin UI. Some uses cases for this trigger include the following:
-- Provide evidence to show auditors connector logic and sources are not
- manipulated outside of proper change control processes.
+- Provide evidence to show auditors connector logic and sources are not manipulated outside of proper change control processes.
- Auto-configure new sources with proper owners using external data sources.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/available/source-deleted.md b/products/idn/docs/identity-now/event-triggers/available/source-deleted.md
index adeb7de04..7779f0f72 100644
--- a/products/idn/docs/identity-now/event-triggers/available/source-deleted.md
+++ b/products/idn/docs/identity-now/event-triggers/available/source-deleted.md
@@ -4,19 +4,17 @@ title: Source Deleted
pagination_label: Source Deleted
sidebar_label: Source Deleted
sidebar_class_name: sourceDeleted
-keywords: ["event", "trigger", "source", "deleted", "available"]
+keywords: ['event', 'trigger', 'source', 'deleted', 'available']
description: Fires after a source is deleted.
slug: /docs/event-triggers/triggers/source-deleted
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context
-Source Deleted events occur when a source is successfully deleted via the API or
-the Admin UI. Some uses cases for this trigger include the following:
+Source Deleted events occur when a source is successfully deleted via the API or the Admin UI. Some uses cases for this trigger include the following:
-- Provide evidence to show auditors that connector logic and sources are not
- manipulated outside of proper change control processes.
+- Provide evidence to show auditors that connector logic and sources are not manipulated outside of proper change control processes.
- Alert admins when a source was deleted incorrectly.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/available/source-updated.md b/products/idn/docs/identity-now/event-triggers/available/source-updated.md
index d809a678d..cea8335a1 100644
--- a/products/idn/docs/identity-now/event-triggers/available/source-updated.md
+++ b/products/idn/docs/identity-now/event-triggers/available/source-updated.md
@@ -4,19 +4,17 @@ title: Source Updated
pagination_label: Source Updated
sidebar_label: Source Updated
sidebar_class_name: sourceUpdated
-keywords: ["event", "trigger", "source", "updated", "available"]
+keywords: ['event', 'trigger', 'source', 'updated', 'available']
description: Fires after a source is updated.
slug: /docs/event-triggers/triggers/source-updated
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context
-Source Updated events occur when configuration changes are made to a source.
-Some uses cases for this trigger include the following:
+Source Updated events occur when configuration changes are made to a source. Some uses cases for this trigger include the following:
-- Provide evidence to show auditors connector logic and sources are not
- manipulated outside of proper change control processes.
+- Provide evidence to show auditors connector logic and sources are not manipulated outside of proper change control processes.
- Trigger review of an updated source.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/available/va-cluster-status-change.md b/products/idn/docs/identity-now/event-triggers/available/va-cluster-status-change.md
index 2d5e91efc..49629d39b 100644
--- a/products/idn/docs/identity-now/event-triggers/available/va-cluster-status-change.md
+++ b/products/idn/docs/identity-now/event-triggers/available/va-cluster-status-change.md
@@ -4,33 +4,26 @@ title: VA Cluster Status Change
pagination_label: VA Cluster Status Change
sidebar_label: VA Cluster Status Change
sidebar_class_name: vaClusterStatusChange
-keywords: ["event", "trigger", "va", "cluster", "status", "change", "available"]
+keywords: ['event', 'trigger', 'va', 'cluster', 'status', 'change', 'available']
description: Fires after the status of a VA cluster has changed.
slug: /docs/event-triggers/triggers/va-cluster-status-change
-tags: ["Event Triggers", "Available Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Available Event Triggers', 'Fire and Forget']
---
## Event Context
-VA (Virtual Appliance) Cluster Status Change Events occur when a health check is
-run on a VA cluster and the health status is different from the previous health
-check. Customers can use this trigger to monitor all the health status changes
-of their VA clusters.
+VA (Virtual Appliance) Cluster Status Change Events occur when a health check is run on a VA cluster and the health status is different from the previous health check. Customers can use this trigger to monitor all the health status changes of their VA clusters.
Some uses cases for this trigger include the following:
- Create real-time health dashboards for VA clusters.
-- Notify an administrator or system to take the appropriate actions when a
- health status changes.
+- Notify an administrator or system to take the appropriate actions when a health status changes.
Additional notes about VA Cluster Status Changes:
- VA cluster health checks run every 30 minutes.
-- This trigger will invoke on any VA cluster health status change (i.e. healthy
- -> unhealthy, unhealthy -> healthy).
-- See
- [troubleshooting virtual appliances](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735)
- for more information.
+- This trigger will invoke on any VA cluster health status change (i.e. healthy -> unhealthy, unhealthy -> healthy).
+- See [troubleshooting virtual appliances](https://community.sailpoint.com/t5/IdentityNow-Connectors/Virtual-Appliance-Troubleshooting-Guide/ta-p/78735) for more information.
Healthy Cluster Source
diff --git a/products/idn/docs/identity-now/event-triggers/early-access/identity-deleted.md b/products/idn/docs/identity-now/event-triggers/early-access/identity-deleted.md
index 39b4c4216..bfd22faf1 100644
--- a/products/idn/docs/identity-now/event-triggers/early-access/identity-deleted.md
+++ b/products/idn/docs/identity-now/event-triggers/early-access/identity-deleted.md
@@ -4,16 +4,15 @@ title: Identity Deleted
pagination_label: Identity Deleted
sidebar_label: Identity Deleted
sidebar_class_name: identityDeleted
-keywords: ["event", "trigger", "identity", "deleted", "early access"]
+keywords: ['event', 'trigger', 'identity', 'deleted', 'early access']
description: Fires after an identity is deleted.
slug: /docs/event-triggers/triggers/identity-deleted
-tags: ["Event Triggers", "Early Access Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Early Access Event Triggers', 'Fire and Forget']
---
:::info
-This is an early access event trigger. Please contact support to have it enabled
-in your tenant.
+This is an early access event trigger. Please contact support to have it enabled in your tenant.
:::
@@ -21,25 +20,14 @@ in your tenant.

-Identity deleted events occur when an identity's associated account is deleted
-from the identity's authoritative source. After accounts are aggregated and the
-identity refresh process finds an identity that is not correlated to an account,
-the associated identity is deleted from IdentityNow. For more information, see
-[Configuring Correlation](https://community.sailpoint.com/t5/Connectors/Configuring-Correlation/ta-p/74045).
-The Identity deleted event contains any identity attributes as they are
-configured in the identity profile. For more information, see
-[Mapping Identity Profiles](https://community.sailpoint.com/t5/Admin-Help/Mapping-Identity-Profiles/ta-p/77877).
+Identity deleted events occur when an identity's associated account is deleted from the identity's authoritative source. After accounts are aggregated and the identity refresh process finds an identity that is not correlated to an account, the associated identity is deleted from IdentityNow. For more information, see [Configuring Correlation](https://community.sailpoint.com/t5/Connectors/Configuring-Correlation/ta-p/74045). The Identity deleted event contains any identity attributes as they are configured in the identity profile. For more information, see [Mapping Identity Profiles](https://community.sailpoint.com/t5/Admin-Help/Mapping-Identity-Profiles/ta-p/77877).
-This event trigger provides a flexible way to extend joiner-mover-leaver
-processes. This provides more proactive governance and ensures users can quickly
-get necessary access when they enter your organization.
+This event trigger provides a flexible way to extend joiner-mover-leaver processes. This provides more proactive governance and ensures users can quickly get necessary access when they enter your organization.
Some uses cases for this trigger include the following:
-- Notify an administrator or system to take the appropriate provisioning actions
- as part of the leaver workflow.
-- Notify a system to trigger another action (e.g. deactivate an employee’s badge
- upon termination).
+- Notify an administrator or system to take the appropriate provisioning actions as part of the leaver workflow.
+- Notify a system to trigger another action (e.g. deactivate an employee’s badge upon termination).
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/early-access/index.mdx b/products/idn/docs/identity-now/event-triggers/early-access/index.mdx
index 47e664ff2..254a29047 100644
--- a/products/idn/docs/identity-now/event-triggers/early-access/index.mdx
+++ b/products/idn/docs/identity-now/event-triggers/early-access/index.mdx
@@ -4,19 +4,16 @@ title: Early Access Event Triggers
pagination_label: Early Access Event Triggers
sidebar_label: Early Access Event Triggers
sidebar_class_name: earlyAccessEventTriggers
-keywords: ["event", "trigger", "early access"]
+keywords: ['event', 'trigger', 'early access']
description: Event triggers that require a support ticket to enable.
sidebar_position: 8
slug: /docs/event-triggers/early-access
-tags: ["Event Triggers", "Early Access Event Triggers"]
+tags: ['Event Triggers', 'Early Access Event Triggers']
---
-import DocCardList from "@theme/DocCardList";
-import { useCurrentSidebarCategory } from "@docusaurus/theme-common";
+import DocCardList from '@theme/DocCardList';
+import {useCurrentSidebarCategory} from '@docusaurus/theme-common';
-New event triggers undergoing active development may appear in the early access
-event trigger list. You can use these triggers by submitting a support ticket to
-have them enabled in your tenant. Because these triggers are early access, they
-are subject to change at any time.
+New event triggers undergoing active development may appear in the early access event trigger list. You can use these triggers by submitting a support ticket to have them enabled in your tenant. Because these triggers are early access, they are subject to change at any time.
diff --git a/products/idn/docs/identity-now/event-triggers/early-access/source-account-created.md b/products/idn/docs/identity-now/event-triggers/early-access/source-account-created.md
index a5f0d4c74..6d228b735 100644
--- a/products/idn/docs/identity-now/event-triggers/early-access/source-account-created.md
+++ b/products/idn/docs/identity-now/event-triggers/early-access/source-account-created.md
@@ -4,28 +4,23 @@ title: Source Account Created
pagination_label: Source Account Created
sidebar_label: Source Account Created
sidebar_class_name: sourceAccountCreated
-keywords: ["event", "trigger", "source", "account", "created", "early access"]
+keywords: ['event', 'trigger', 'source', 'account', 'created', 'early access']
description: Fires after a source account is created.
slug: /docs/event-triggers/triggers/source-account-created
-tags: ["Event Triggers", "Early Access Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Early Access Event Triggers', 'Fire and Forget']
---
:::info
-This is an early access event trigger. Please contact support to have it enabled
-in your tenant.
+This is an early access event trigger. Please contact support to have it enabled in your tenant.
:::
## Event Context
-Source Account Created events occur after a new account is detected during an
-account aggregration and refresh from a source. This trigger cannot determine
-whether account creation happened on a source or in IdentityNow. It omits events
-related to IdentityNow accounts, such as the IdentityNow Admin.
+Source Account Created events occur after a new account is detected during an account aggregration and refresh from a source. This trigger cannot determine whether account creation happened on a source or in IdentityNow. It omits events related to IdentityNow accounts, such as the IdentityNow Admin.
-Use this event trigger to watch for new accounts with highly privileged access,
-such as an account created in Active Directory Domain Admins.
+Use this event trigger to watch for new accounts with highly privileged access, such as an account created in Active Directory Domain Admins.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/early-access/source-account-deleted.md b/products/idn/docs/identity-now/event-triggers/early-access/source-account-deleted.md
index f047d3615..6a955fab0 100644
--- a/products/idn/docs/identity-now/event-triggers/early-access/source-account-deleted.md
+++ b/products/idn/docs/identity-now/event-triggers/early-access/source-account-deleted.md
@@ -4,30 +4,23 @@ title: Source Account Deleted
pagination_label: Source Account Deleted
sidebar_label: Source Account Deleted
sidebar_class_name: sourceAccountDeleted
-keywords: ["event", "trigger", "source", "account", "deleted", "early access"]
+keywords: ['event', 'trigger', 'source', 'account', 'deleted', 'early access']
description: Fires after a source account is deleted.
slug: /docs/event-triggers/triggers/source-account-deleted
-tags: ["Event Triggers", "Early Access Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Early Access Event Triggers', 'Fire and Forget']
---
:::info
-This is an early access event trigger. Please contact support to have it enabled
-in your tenant.
+This is an early access event trigger. Please contact support to have it enabled in your tenant.
:::
## Event Context
-Source Account Deleted events occur whenever an account is deleted from its
-source during an account aggregation operation. The account may have been
-manually removed or deleted as the result of a provisioning event. The trigger
-cannot determine whether the account deletion happened on a source or in
-IdentityNow. It omits events related to IdentityNow accounts, such as the
-IdentityNow Admin.
+Source Account Deleted events occur whenever an account is deleted from its source during an account aggregation operation. The account may have been manually removed or deleted as the result of a provisioning event. The trigger cannot determine whether the account deletion happened on a source or in IdentityNow. It omits events related to IdentityNow accounts, such as the IdentityNow Admin.
-Use this event trigger to watch for deletions of authoritative accounts, such as
-an account deleted on Workday.
+Use this event trigger to watch for deletions of authoritative accounts, such as an account deleted on Workday.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/early-access/source-account-updated.md b/products/idn/docs/identity-now/event-triggers/early-access/source-account-updated.md
index fe6e8a202..68f091916 100644
--- a/products/idn/docs/identity-now/event-triggers/early-access/source-account-updated.md
+++ b/products/idn/docs/identity-now/event-triggers/early-access/source-account-updated.md
@@ -4,36 +4,29 @@ title: Source Account Updated
pagination_label: Source Account Updated
sidebar_label: Source Account Updated
sidebar_class_name: sourceAccountUpdated
-keywords: ["event", "trigger", "source", "account", "updated", "early access"]
+keywords: ['event', 'trigger', 'source', 'account', 'updated', 'early access']
description: Fires after a source account is updated.
pagination_next: docs/identity-now/event-triggers/event-triggers
slug: /docs/event-triggers/triggers/source-account-updated
-tags: ["Event Triggers", "Early Access Event Triggers", "Fire and Forget"]
+tags: ['Event Triggers', 'Early Access Event Triggers', 'Fire and Forget']
---
:::info
-This is an early access event trigger. Please contact support to have it enabled
-in your tenant.
+This is an early access event trigger. Please contact support to have it enabled in your tenant.
:::
## Event Context
-Source Account Updated events occur whenever one or more account attributes
-change on a single account during an account aggregation operation. The trigger
-cannot determine whether the account update happened on a source or in
-IdentityNow. It omits events related to IdentityNow accounts, such as the
-IdentityNow Admin. The following actions are considered updates:
+Source Account Updated events occur whenever one or more account attributes change on a single account during an account aggregation operation. The trigger cannot determine whether the account update happened on a source or in IdentityNow. It omits events related to IdentityNow accounts, such as the IdentityNow Admin. The following actions are considered updates:
- Update account attributes
- Enable or disable an account
- Lock or unlock source accounts
- Change source account password
-Use this event trigger to watch for updates to accounts that add highly
-privileged access, such as an account that is granted privileged access on a
-sensitive source.
+Use this event trigger to watch for updates to accounts that add highly privileged access, such as an account that is granted privileged access on a sensitive source.
This is an example input from this trigger:
diff --git a/products/idn/docs/identity-now/event-triggers/filtering-events.md b/products/idn/docs/identity-now/event-triggers/filtering-events.md
index f5e7e2f30..aae5356e1 100644
--- a/products/idn/docs/identity-now/event-triggers/filtering-events.md
+++ b/products/idn/docs/identity-now/event-triggers/filtering-events.md
@@ -5,41 +5,19 @@ pagination_label: Filtering Events
sidebar_label: Filtering Events
sidebar_position: 4
sidebar_class_name: filteringEvents
-keywords: ["filtering", "events"]
-description:
- Many triggers can produce a staggering amount of events if left unfiltered.
- Event filtering helps you solve this problem.
+keywords: ['filtering', 'events']
+description: Many triggers can produce a staggering amount of events if left unfiltered. Event filtering helps you solve this problem.
slug: /docs/event-triggers/filtering-events
-tags: ["Event Triggers"]
+tags: ['Event Triggers']
---
## What is a Filter
-Many triggers can produce a staggering amount of events if left unfiltered,
-resulting in more network traffic and more processing time on a subscribing
-service. Your subscribing service usually only needs to be notified of events
-containing a key attribute or value you want to process. For example, the
-Identity Attributes Changed trigger emits an event whenever an identity has a
-change in attributes. This can occur during the mover process when an identity
-changes departments or a manager is promoted, resulting in several identities
-receiving a new manager. Rather than inundate your subscribing service with
-every identity change, you can use an event trigger filter to specify which
-events your service is interested in processing.
+Many triggers can produce a staggering amount of events if left unfiltered, resulting in more network traffic and more processing time on a subscribing service. Your subscribing service usually only needs to be notified of events containing a key attribute or value you want to process. For example, the Identity Attributes Changed trigger emits an event whenever an identity has a change in attributes. This can occur during the mover process when an identity changes departments or a manager is promoted, resulting in several identities receiving a new manager. Rather than inundate your subscribing service with every identity change, you can use an event trigger filter to specify which events your service is interested in processing.
## Benefits of Using Filters
-Network bandwidth and processing power come at a cost, especially when you are
-using managed solutions like AWS or no-code providers like Zapier. Without
-filtering, a subscribing service would be sent every single event that the
-trigger receives. The first thing any subscriber must do in this scenario is
-inspect each event to figure out which ones it must process and which ones it
-can ignore. Taking this approach with managed providers that charge per
-invocation, like AWS Lambda, can become expensive. Furthermore, some no-code
-providers may put a limit on the total number of invocations that a service can
-make in a given month, which would be quickly exhausted with this approach.
-Trigger filters take the filtering logic out of your subscribing service and
-place it on the event trigger within SailPoint, so you only receive the events
-matching your filter criteria.
+Network bandwidth and processing power come at a cost, especially when you are using managed solutions like AWS or no-code providers like Zapier. Without filtering, a subscribing service would be sent every single event that the trigger receives. The first thing any subscriber must do in this scenario is inspect each event to figure out which ones it must process and which ones it can ignore. Taking this approach with managed providers that charge per invocation, like AWS Lambda, can become expensive. Furthermore, some no-code providers may put a limit on the total number of invocations that a service can make in a given month, which would be quickly exhausted with this approach. Trigger filters take the filtering logic out of your subscribing service and place it on the event trigger within SailPoint, so you only receive the events matching your filter criteria.
## Constructing a Filter
@@ -55,61 +33,49 @@ Although variable selection in Workflows users Goessner, the trigger filter fiel
### Expressions
-JSONPath expressions specify a path to an element or array of elements in a JSON
-structure. Expressions are used to select data in a JSON structure to check for
-the existence of attributes or to narrow down the data where the filter logic is
-applied.
+JSONPath expressions specify a path to an element or array of elements in a JSON structure. Expressions are used to select data in a JSON structure to check for the existence of attributes or to narrow down the data where the filter logic is applied.
-| Expression | Description | Example |
-| ----------------- | ------------------------------------------------------------------------ | ----------------------------------------- |
-| $ | **Root** - The root object / element. | $ |
-| @ | **Current** - The current object / element of an array. | $.changes[?(@.attribute == "department")] |
-| . | **Child operator** - Selects a child element of an object. | $.identity |
-| .. | **Recursive descent** - JSONPath borrows this syntax from E4X. | $..id |
-| \* | **Wildcard** - All objects / elements regardless of their names. | $.changes[*] |
-| [] | **Subscript** - In Javascript and JSON, it is the native array operator. | $.changes[1].attribute |
-| [,] | **Union** - Selects elements of an array. | $.changes[0,1,2] |
-| [start:stop:step] | **Array slice** - Selects elements of an array. | $.changes[0:2:1] |
-| [:n] | **Array slice** - Selects the first `n` elements of an array. | $.changes[:2] |
-| [-n:] | **Array slice** - Selects the last `n` elements of an array. | $.changes[-1:] |
-| ?() | **Filter expression** - Applies a filter expression. | $[?($.identity.name == "john.doe")] |
-| () | **Script expression** - Applies a script expression. | $.changes[(@.length-1)] |
+| Expression | Description | Example |
+| --- | --- | --- |
+| $ | **Root** - The root object / element. | $ |
+| @ | **Current** - The current object / element of an array. | $.changes[?(@.attribute == "department")] |
+| . | **Child operator** - Selects a child element of an object. | $.identity |
+| .. | **Recursive descent** - JSONPath borrows this syntax from E4X. | $..id |
+| \* | **Wildcard** - All objects / elements regardless of their names. | $.changes[*] |
+| [] | **Subscript** - In Javascript and JSON, it is the native array operator. | $.changes[1].attribute |
+| [,] | **Union** - Selects elements of an array. | $.changes[0,1,2] |
+| [start:stop:step] | **Array slice** - Selects elements of an array. | $.changes[0:2:1] |
+| [:n] | **Array slice** - Selects the first `n` elements of an array. | $.changes[:2] |
+| [-n:] | **Array slice** - Selects the last `n` elements of an array. | $.changes[-1:] |
+| ?() | **Filter expression** - Applies a filter expression. | $[?($.identity.name == "john.doe")] |
+| () | **Script expression** - Applies a script expression. | $.changes[(@.length-1)] |
### Operators
JSONPath operators provide more options to filter JSON structures.
-| Operator | Description | Example |
-| -------- | ------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- |
-| == | **Equals to** - Evaluates to `true` if operands match. | $[?($.identity.name == "john.doe")] |
-| != | **Not equal to** - Evaluates to `true` if operands do not match. | $[?($.identity.name != "george.washington")] |
-| > | **Greater than** - Evaluates to `true` if the left operand is greater than the right operand. It works on strings and numbers. | $[?($.attributes.created > '2020-04-27T16:48:33.200Z')] |
-| >= | **Greater than or equal to** - Evaluates to `true` if the left operand is greater than or equal to the right operand. | $[?($.attributes.created >= '2020-04-27T16:48:33.597Z')] |
-| < | **Less than** - Evaluates to `true` if the left operand is less than the right operand. | $[?($.attributes.created < '2020-04-27T16:48:33.200Z')] |
-| <= | **Less than or equal to** - Evaluates to `true` if the left operand is less than or equal to the right operand. | $[?($.attributes.created <= '2020-04-27T16:48:33.200Z')] |
-| && | Logical **AND** operator that evaluates `true` only if both conditions are `true`. | $.changes[?(@.attribute == "cloudLifecycleState" && @.newValue == "terminated")] |
-| ! | **Not** - Negates the boolean expression. | $.identity.attributes[?(!@.alternateEmail)] |
-| \|\| | Logical **OR** operator that evaluates `true` if at least one condition is `true`. | $.changes[?(@.attribute == "cloudLifecycleState" \|\| @.attribute == "department")] |
-| contains | **Contains** - Checks whether a string contains the specified substring (case sensitive). | $[?($.identity.name contains "john")] |
+| Operator | Description | Example |
+| --- | --- | --- |
+| == | **Equals to** - Evaluates to `true` if operands match. | $[?($.identity.name == "john.doe")] |
+| != | **Not equal to** - Evaluates to `true` if operands do not match. | $[?($.identity.name != "george.washington")] |
+| > | **Greater than** - Evaluates to `true` if the left operand is greater than the right operand. It works on strings and numbers. | $[?($.attributes.created > '2020-04-27T16:48:33.200Z')] |
+| >= | **Greater than or equal to** - Evaluates to `true` if the left operand is greater than or equal to the right operand. | $[?($.attributes.created >= '2020-04-27T16:48:33.597Z')] |
+| < | **Less than** - Evaluates to `true` if the left operand is less than the right operand. | $[?($.attributes.created < '2020-04-27T16:48:33.200Z')] |
+| <= | **Less than or equal to** - Evaluates to `true` if the left operand is less than or equal to the right operand. | $[?($.attributes.created <= '2020-04-27T16:48:33.200Z')] |
+| && | Logical **AND** operator that evaluates `true` only if both conditions are `true`. | $.changes[?(@.attribute == "cloudLifecycleState" && @.newValue == "terminated")] |
+| ! | **Not** - Negates the boolean expression. | $.identity.attributes[?(!@.alternateEmail)] |
+| \|\| | Logical **OR** operator that evaluates `true` if at least one condition is `true`. | $.changes[?(@.attribute == "cloudLifecycleState" \|\| @.attribute == "department")] |
+| contains | **Contains** - Checks whether a string contains the specified substring (case sensitive). | $[?($.identity.name contains "john")] |
### Developing Filters
-Developing a filter can be faster when you use a tool like an online
-[JSONpath editor](https://jsonpath.herokuapp.com/). These tools can provide
-quick feedback on your filter, allowing you to focus on the exact filter
-expression you want before testing it on a trigger.
+Developing a filter can be faster when you use a tool like an online [JSONpath editor](https://jsonpath.herokuapp.com/). These tools can provide quick feedback on your filter, allowing you to focus on the exact filter expression you want before testing it on a trigger.
-Start by opening a [JSONpath editor](https://jsonpath.herokuapp.com/) in your
-browser. Make sure that the correct implementation is selected if there is more
-than one option. In the case of event trigger filters, you will want to select the **Jayway** option. You can then paste in an example trigger input and start
-crafting your JSONpath expression.
+Start by opening a [JSONpath editor](https://jsonpath.herokuapp.com/) in your browser. Make sure that the correct implementation is selected if there is more than one option. In the case of event trigger filters, you will want to select the **Jayway** option. You can then paste in an example trigger input and start crafting your JSONpath expression.

-Most of the examples provided in the operator tables above can be used against
-the Identity Attributes Changed event trigger input, as seen below. You can find
-all of the input/output schemas for the other available triggers in our
-[API specification](/idn/api/beta/triggers#available-event-triggers).
+Most of the examples provided in the operator tables above can be used against the Identity Attributes Changed event trigger input, as seen below. You can find all of the input/output schemas for the other available triggers in our [API specification](/idn/api/beta/triggers#available-event-triggers).
```json
{
@@ -148,29 +114,17 @@ all of the input/output schemas for the other available triggers in our
## Validating Filters
-When you are finished developing your JSONpath filter, you must validate it with
-SailPoint's trigger service. There are two ways to do this: use the UI or the
-API.
+When you are finished developing your JSONpath filter, you must validate it with SailPoint's trigger service. There are two ways to do this: use the UI or the API.
### Validating Filters Using the UI
-To validate a filter using the UI, subscribe to a new event trigger or edit an
-existing one. In the configuration options, paste your JSONpath expression in
-the `Filter` input box and select `Update`. If you do not receive an error
-message, then your filter expression is valid with SailPoint.
+To validate a filter using the UI, subscribe to a new event trigger or edit an existing one. In the configuration options, paste your JSONpath expression in the `Filter` input box and select `Update`. If you do not receive an error message, then your filter expression is valid with SailPoint.

### Validating Filters Using the API
-You can validate a trigger filter by using the
-[validate filter](/idn/api/beta/validate-filter) API endpoint. You must escape
-any double quotes, as seen in the example payload in the API description. Also,
-you must provide a sample input for the validation engine to run against. It is
-best to use the input example included in the input/output schemas for the event
-trigger you want to apply your filter to. Refer to
-[this table](/idn/api/beta/triggers#available-event-triggers) to find the schema
-of your event trigger. This is an example request:
+You can validate a trigger filter by using the [validate filter](/idn/api/beta/validate-filter) API endpoint. You must escape any double quotes, as seen in the example payload in the API description. Also, you must provide a sample input for the validation engine to run against. It is best to use the input example included in the input/output schemas for the event trigger you want to apply your filter to. Refer to [this table](/idn/api/beta/triggers#available-event-triggers) to find the schema of your event trigger. This is an example request:
```text
POST https://{tenant}.api.identitynow.com/beta/trigger-subscriptions/validate-filter
@@ -216,25 +170,10 @@ POST https://{tenant}.api.identitynow.com/beta/trigger-subscriptions/validate-fi
## Testing Filters
-If SailPoint accepts your trigger filter, you must test whether it actually
-works. You must configure your trigger subscription to point to the URL of your
-testing service. [webhook.site](https://webhook.site) is an easy to use testing
-service. Just copy the unique URL it generates and paste it into your
-subscription's integration URL field. The easiest way to test a trigger
-subscription is to use the UI to fire off a test event.
+If SailPoint accepts your trigger filter, you must test whether it actually works. You must configure your trigger subscription to point to the URL of your testing service. [webhook.site](https://webhook.site) is an easy to use testing service. Just copy the unique URL it generates and paste it into your subscription's integration URL field. The easiest way to test a trigger subscription is to use the UI to fire off a test event.

-Once you fire off a test event, monitor your webhook.site webpage for an
-incoming event. If the filter matches the test input, you will an event come in.
-If the filter does not match the input, then it will nott fire. Test both
-scenarios to make sure your filter is not always evaluating to `true`, and that
-it will indeed evaluate to `false` under the correct circumstances. For example,
-the filter `$[?($.identity.name contains "john")]` will match the test event for
-Identity Attributes Changed and you will see an event in webhook.site, but you
-also want to make sure that `$[?($.identity.name contains "archer")]` doesn't
-fire because the test input is always the same.
+Once you fire off a test event, monitor your webhook.site webpage for an incoming event. If the filter matches the test input, you will an event come in. If the filter does not match the input, then it will nott fire. Test both scenarios to make sure your filter is not always evaluating to `true`, and that it will indeed evaluate to `false` under the correct circumstances. For example, the filter `$[?($.identity.name contains "john")]` will match the test event for Identity Attributes Changed and you will see an event in webhook.site, but you also want to make sure that `$[?($.identity.name contains "archer")]` doesn't fire because the test input is always the same.
-If you want to control the test input to validate your filter against a more
-robust set of data, use the
-[test invocation](/idn/api/beta/start-test-invocation) API endpoint.
+If you want to control the test input to validate your filter against a more robust set of data, use the [test invocation](/idn/api/beta/start-test-invocation) API endpoint.
diff --git a/products/idn/docs/identity-now/event-triggers/index.md b/products/idn/docs/identity-now/event-triggers/index.md
index 2afe2dd18..97bce895a 100644
--- a/products/idn/docs/identity-now/event-triggers/index.md
+++ b/products/idn/docs/identity-now/event-triggers/index.md
@@ -5,53 +5,24 @@ pagination_label: Event Triggers
sidebar_label: Event Triggers
sidebar_position: 3
sidebar_class_name: eventTriggers
-keywords: ["event", "triggers", "webhooks"]
-description:
- The result of any action performed in a service is called an event. Services
- like IdentityNow constantly generate events like an update to a setting or the
- completion of an account aggregation.
+keywords: ['event', 'triggers', 'webhooks']
+description: The result of any action performed in a service is called an event. Services like IdentityNow constantly generate events like an update to a setting or the completion of an account aggregation.
slug: /docs/event-triggers
-tags: ["Event Triggers"]
+tags: ['Event Triggers']
---
## What Are Triggers
-The result of any action performed in a service is called an **event**. Services
-like IdentityNow constantly generate events like an update to a setting or the
-completion of an account aggregation. Most events a service generates are of
-little value to clients, so services create event triggers, also known as web
-hooks, that allow clients to subscribe to specific events they are interested
-in. Similar to news letters or RSS feeds, each subscription tells the service
-what event a client is interested in and where to send the client the
-notification.
+The result of any action performed in a service is called an **event**. Services like IdentityNow constantly generate events like an update to a setting or the completion of an account aggregation. Most events a service generates are of little value to clients, so services create event triggers, also known as web hooks, that allow clients to subscribe to specific events they are interested in. Similar to news letters or RSS feeds, each subscription tells the service what event a client is interested in and where to send the client the notification.
## How Are Triggers Different from APIs
-The biggest difference between event triggers and APIs is how data is accessed.
-Requesting data with an API is an active process, but receiving data from an
-event trigger is a passive process. Clients who want to get the latest data with
-an API must initiate the request. Clients who subscribe to an event trigger do
-not need to initiate a request. They are notified when the event occurs. This is
-similar to keeping up with the latest world news on the internet. You can
-initiate the request for data by opening a news website in your browser, or you
-can subscribe to a mail list to receive the latest news as it happens.
+The biggest difference between event triggers and APIs is how data is accessed. Requesting data with an API is an active process, but receiving data from an event trigger is a passive process. Clients who want to get the latest data with an API must initiate the request. Clients who subscribe to an event trigger do not need to initiate a request. They are notified when the event occurs. This is similar to keeping up with the latest world news on the internet. You can initiate the request for data by opening a news website in your browser, or you can subscribe to a mail list to receive the latest news as it happens.
## When to Use Triggers
-It is best to use event triggers when you need to react to an event in
-real-time. Although you can set up a polling mechanism using APIs, polling uses
-more bandwidth and resources, and if you poll too quickly, you can reach an
-API's rate limits. Event triggers use less bandwidth, they do not affect your
-API rate limit, and they are as close as you can get to real-time. However,
-event triggers have downsides to consider. They must be accessible from the
-public internet so the trigger service knows where to send the notification, and
-they can be harder to configure and operate than APIs are.
+It is best to use event triggers when you need to react to an event in real-time. Although you can set up a polling mechanism using APIs, polling uses more bandwidth and resources, and if you poll too quickly, you can reach an API's rate limits. Event triggers use less bandwidth, they do not affect your API rate limit, and they are as close as you can get to real-time. However, event triggers have downsides to consider. They must be accessible from the public internet so the trigger service knows where to send the notification, and they can be harder to configure and operate than APIs are.
## How to Get Started With Event Triggers
-Event triggers require different setup and testing steps than APIs do, so you
-should follow each document to better understand event triggers and the
-necessary steps to configure one. If this is your first time using event
-triggers, then you should use the
-[webhook testing service](./preparing-a-subscriber-service.md#webhook-testing-service)
-as you follow along.
+Event triggers require different setup and testing steps than APIs do, so you should follow each document to better understand event triggers and the necessary steps to configure one. If this is your first time using event triggers, then you should use the [webhook testing service](./preparing-a-subscriber-service.md#webhook-testing-service) as you follow along.
diff --git a/products/idn/docs/identity-now/event-triggers/preparing-a-subscriber-service.md b/products/idn/docs/identity-now/event-triggers/preparing-a-subscriber-service.md
index 00f4bafa5..3b657f2aa 100644
--- a/products/idn/docs/identity-now/event-triggers/preparing-a-subscriber-service.md
+++ b/products/idn/docs/identity-now/event-triggers/preparing-a-subscriber-service.md
@@ -5,70 +5,34 @@ pagination_title: Preparing a Subscriber Service
sidebar_label: Preparing a Subscriber Service
sidebar_position: 2
sidebar_class_name: preparingSubscriberService
-keywords: ["event", "triggers", "subscriber"]
-description:
- Before you can subscribe to an event trigger, you must prepare a service that
- can accept incoming HTTP requests from the event trigger service.
+keywords: ['event', 'triggers', 'subscriber']
+description: Before you can subscribe to an event trigger, you must prepare a service that can accept incoming HTTP requests from the event trigger service.
slug: /docs/event-triggers/preparing-subscriber-service
-tags: ["Event Triggers"]
+tags: ['Event Triggers']
---
-Before you can subscribe to an event trigger, you must prepare a service that
-can accept incoming HTTP requests from the event trigger service. More
-specifically, your client service must accept a POST request to an endpoint of
-its choosing, with the ability to parse the JSON data sent by the trigger. There
-are many ways to accomplish this, but this guide covers four of the most common
-types of client services you can build to handle event triggers.
+Before you can subscribe to an event trigger, you must prepare a service that can accept incoming HTTP requests from the event trigger service. More specifically, your client service must accept a POST request to an endpoint of its choosing, with the ability to parse the JSON data sent by the trigger. There are many ways to accomplish this, but this guide covers four of the most common types of client services you can build to handle event triggers.
## Webhook Testing Service
-There are many webhook testing websites that generate a unique URL you can use
-to subscribe to an event trigger and explore the data sent by the trigger. One
-site is https://webhook.site. This site generates a unique URL whenever you open
-it, which you can copy and paste into the subscription configuration in
-IdentityNow. Any events that the trigger generates will be sent to this website
-for you to analyze.
+There are many webhook testing websites that generate a unique URL you can use to subscribe to an event trigger and explore the data sent by the trigger. One site is https://webhook.site. This site generates a unique URL whenever you open it, which you can copy and paste into the subscription configuration in IdentityNow. Any events that the trigger generates will be sent to this website for you to analyze.

-The purpose of webhook testing services is to make it easy to set up a trigger
-and see the data of the events that will eventually be sent to your production
-service. This can help in the early development process when you explore the
-data the event trigger sends and how to best access the data you need.
+The purpose of webhook testing services is to make it easy to set up a trigger and see the data of the events that will eventually be sent to your production service. This can help in the early development process when you explore the data the event trigger sends and how to best access the data you need.
## Native SaaS Workflows
-Some SaaS vendors provide built-in workflow builders in their products so you do
-not have to use a no-code provider. Slack, for example, has a premium
-[workflow builder](https://slack.com/help/articles/360035692513-Guide-to-Workflow-Builder)
-feature that generates a unique URL you can use to configure your subscription.
-Slack's workflow builder can then listen for events sent by your trigger and
-perform Slack specific actions on the data, like sending a user a message when
-his or her access request is approved.
+Some SaaS vendors provide built-in workflow builders in their products so you do not have to use a no-code provider. Slack, for example, has a premium [workflow builder](https://slack.com/help/articles/360035692513-Guide-to-Workflow-Builder) feature that generates a unique URL you can use to configure your subscription. Slack's workflow builder can then listen for events sent by your trigger and perform Slack specific actions on the data, like sending a user a message when his or her access request is approved.

## No-code Provider
-No-code/low-code providers, like Zapier and Microsoft Power Automate, make it
-easy to consume event triggers and perform actions based on the event data. They
-are popular solutions for those looking to prototype or quickly create automated
-business processes, and they cater to novices and advanced users alike. Each
-no-code provider has documentation about how to create a new workflow and
-subscribe to an event trigger or webhook, so you must find the relevant
-documentation for your no-code provider to learn how to set one up. Zapier has
-the ability to configure a webhook action that generates a unique URL you can
-configure in your event trigger subscription.
+No-code/low-code providers, like Zapier and Microsoft Power Automate, make it easy to consume event triggers and perform actions based on the event data. They are popular solutions for those looking to prototype or quickly create automated business processes, and they cater to novices and advanced users alike. Each no-code provider has documentation about how to create a new workflow and subscribe to an event trigger or webhook, so you must find the relevant documentation for your no-code provider to learn how to set one up. Zapier has the ability to configure a webhook action that generates a unique URL you can configure in your event trigger subscription.

## Custom Application
-A custom application is one you write in a language of your choosing and host in
-your own infrastructure, cloud, or on-premise. This is the most advanced option
-for implementing an event trigger client service. Although it requires a great
-deal of skill and knowledge to build, deploy, and operate your own service that
-can consume requests over HTTP, a custom application offers the most power and
-flexibility to implement your use cases. You can learn more about custom
-applications by checking out our
-[Event Trigger Example Application](https://github.com/sailpoint-oss/event-trigger-examples).
+A custom application is one you write in a language of your choosing and host in your own infrastructure, cloud, or on-premise. This is the most advanced option for implementing an event trigger client service. Although it requires a great deal of skill and knowledge to build, deploy, and operate your own service that can consume requests over HTTP, a custom application offers the most power and flexibility to implement your use cases. You can learn more about custom applications by checking out our [Event Trigger Example Application](https://github.com/sailpoint-oss/event-trigger-examples).
diff --git a/products/idn/docs/identity-now/event-triggers/responding-to-a-request-response-trigger.mdx b/products/idn/docs/identity-now/event-triggers/responding-to-a-request-response-trigger.mdx
index 55338da62..cd016ff0e 100644
--- a/products/idn/docs/identity-now/event-triggers/responding-to-a-request-response-trigger.mdx
+++ b/products/idn/docs/identity-now/event-triggers/responding-to-a-request-response-trigger.mdx
@@ -5,32 +5,24 @@ pagination_label: Responding To Request Response Triggers
sidebar_label: Responding To Request Response Triggers
sidebar_position: 6
sidebar_class_name: respondingRequestResponseTriggers
-keywords: ["event", "trigger", "request reseponse"]
-description:
- You can specify how your application interacts with a REQUEST_RESPONSE type
- trigger service by selecting an invocation response mode in the Response Type
- dropdown when editing or creating a REQUEST_RESPONSE subscription.
+keywords: ['event', 'trigger', 'request reseponse']
+description: You can specify how your application interacts with a REQUEST_RESPONSE type trigger service by selecting an invocation response mode in the Response Type dropdown when editing or creating a REQUEST_RESPONSE subscription.
slug: /docs/event-triggers/responding-request-response-trigger
-tags: ["Event Triggers"]
+tags: ['Event Triggers']
---
-import Tabs from "@theme/Tabs";
-import TabItem from "@theme/TabItem";
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
## Invocation Response Modes for REQUEST_RESPONSE Type Triggers
-You can specify how your application interacts with a `REQUEST_RESPONSE` type
-trigger service by selecting an invocation response mode in the **Response
-Type** dropdown when editing or creating a `REQUEST_RESPONSE` subscription.
-There are three response modes to choose from: `SYNC`, `ASYNC`, and `DYNAMIC`.
-These response modes are only available when the subscription type is set to
-`HTTP`.
+You can specify how your application interacts with a `REQUEST_RESPONSE` type trigger service by selecting an invocation response mode in the **Response Type** dropdown when editing or creating a `REQUEST_RESPONSE` subscription. There are three response modes to choose from: `SYNC`, `ASYNC`, and `DYNAMIC`. These response modes are only available when the subscription type is set to `HTTP`.
-| Response Modes | Description |
-| -------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: |
-| `SYNC` | This type of response creates a _synchronous_ flow between the trigger service and the custom application. Once a trigger has been invoked, the custom application is expected to respond within 10 seconds. If the application takes longer than 10 seconds to respond, the trigger invocation will terminate without making any decisions. |
-| `ASYNC` | This type of response creates an _asynchronous_ flow between the trigger service and the custom application. When a trigger is invoked, the custom application does not need to respond immediately. The trigger service will provide a URL and a secret that the custom application can use to complete the invocation at a later time. The application must complete the invocation before the configured deadline on the subscription. |
-| `DYNAMIC` | This type of response gives the custom application the ability to choose whether it handles the invocation request synchronously or asynchronously on a per-event basis. In some cases, the application may choose `SYNC` mode because it is able to respond quickly to the invocation. In other cases, it may choose `ASYNC` because it needs to run a long running task before responding to the invocation. |
+| Response Modes | Description |
+| --- | :-: |
+| `SYNC` | This type of response creates a _synchronous_ flow between the trigger service and the custom application. Once a trigger has been invoked, the custom application is expected to respond within 10 seconds. If the application takes longer than 10 seconds to respond, the trigger invocation will terminate without making any decisions. |
+| `ASYNC` | This type of response creates an _asynchronous_ flow between the trigger service and the custom application. When a trigger is invoked, the custom application does not need to respond immediately. The trigger service will provide a URL and a secret that the custom application can use to complete the invocation at a later time. The application must complete the invocation before the configured deadline on the subscription. |
+| `DYNAMIC` | This type of response gives the custom application the ability to choose whether it handles the invocation request synchronously or asynchronously on a per-event basis. In some cases, the application may choose `SYNC` mode because it is able to respond quickly to the invocation. In other cases, it may choose `ASYNC` because it needs to run a long running task before responding to the invocation. |
## Responding to REQUEST_RESPONSE Trigger
@@ -40,12 +32,7 @@ These response modes are only available when the subscription type is set to
-The custom application responds to the trigger invocation with an appropriate
-payload. For example, the application may receive a request from the Access
-Request Dynamic Approver trigger. The application will have **10 seconds** to
-analyze the event details and respond with a 200 (OK) status code and a response
-payload that contains the identity to add to the approval chain. For example,
-the response may look like this:
+The custom application responds to the trigger invocation with an appropriate payload. For example, the application may receive a request from the Access Request Dynamic Approver trigger. The application will have **10 seconds** to analyze the event details and respond with a 200 (OK) status code and a response payload that contains the identity to add to the approval chain. For example, the response may look like this:
200 (OK)
@@ -63,13 +50,7 @@ the response may look like this:
-The custom application only needs to acknowledge that it has received the
-trigger invocation request by returning an HTTP status of 200 (OK) with an empty
-JSON object (ex. `{}`) in the response body within **10 seconds** of receiving
-the event. It then has until the configured deadline on the subscription to
-provide a full response to the invocation. For example, the application may
-receive a request from the Access Request Dynamic Approver trigger. An example
-of the request payload that the application might receive is as follows:
+The custom application only needs to acknowledge that it has received the trigger invocation request by returning an HTTP status of 200 (OK) with an empty JSON object (ex. `{}`) in the response body within **10 seconds** of receiving the event. It then has until the configured deadline on the subscription to provide a full response to the invocation. For example, the application may receive a request from the Access Request Dynamic Approver trigger. An example of the request payload that the application might receive is as follows:
```json
{
@@ -104,8 +85,7 @@ of the request payload that the application might receive is as follows:
}
```
-The application will immediately respond to the invocation with a 200 (OK)
-status code and an empty JSON object.
+The application will immediately respond to the invocation with a 200 (OK) status code and an empty JSON object.
200 (OK)
@@ -113,13 +93,9 @@ status code and an empty JSON object.
{}
```
-Once the application has made a decision on how to respond, it will use the
-`callbackURL` and `secret` provided in the `_metadata` object from the original
-request to complete the invocation. An example response might look like the
-following:
+Once the application has made a decision on how to respond, it will use the `callbackURL` and `secret` provided in the `_metadata` object from the original request to complete the invocation. An example response might look like the following:
-POST
-`https://{tenant}.api.identitynow.com/beta/trigger-invocations/e9103ca9-02c4-bb0f-9441-94b3af012345/complete`
+POST `https://{tenant}.api.identitynow.com/beta/trigger-invocations/e9103ca9-02c4-bb0f-9441-94b3af012345/complete`
```json
{
@@ -135,17 +111,9 @@ POST
-The custom application determines arbitrarily whether to respond to the trigger
-invocation as `SYNC` or `ASYNC`. If the application wishes to respond as `SYNC`,
-it should follow the directions for a `SYNC` response type, responding within
-**10 seconds** of the invocation. In the case of `ASYNC`, the custom application
-only needs to acknowledge that it has received the trigger invocation request
-with a 202 (Accepted) within **10 seconds** of receiving the event and complete
-the invocation at a later time using the `callbackURL` and `secret` provided in
-the `_metadata` object.
+The custom application determines arbitrarily whether to respond to the trigger invocation as `SYNC` or `ASYNC`. If the application wishes to respond as `SYNC`, it should follow the directions for a `SYNC` response type, responding within **10 seconds** of the invocation. In the case of `ASYNC`, the custom application only needs to acknowledge that it has received the trigger invocation request with a 202 (Accepted) within **10 seconds** of receiving the event and complete the invocation at a later time using the `callbackURL` and `secret` provided in the `_metadata` object.
-An example of the request payload that the application might receive is as
-follows:
+An example of the request payload that the application might receive is as follows:
```json
{
@@ -192,8 +160,7 @@ To respond as `SYNC`, simply respond to the invocation within 10 seconds.
}
```
-To respond as `ASYNC`, start by responding to the invocation with a 202
-(Accepted).
+To respond as `ASYNC`, start by responding to the invocation with a 202 (Accepted).
202 (Accepted)
@@ -201,11 +168,9 @@ To respond as `ASYNC`, start by responding to the invocation with a 202
{}
```
-Then, use the `callbackURL` and `secret` to send a POST request to the
-invocation with the decision.
+Then, use the `callbackURL` and `secret` to send a POST request to the invocation with the decision.
-POST
-`https://{tenant}.api.identitynow.com/beta/trigger-invocations/e9103ca9-02c4-bb0f-9441-94b3af012345/complete`
+POST `https://{tenant}.api.identitynow.com/beta/trigger-invocations/e9103ca9-02c4-bb0f-9441-94b3af012345/complete`
```json
{
@@ -225,9 +190,4 @@ POST
## Trigger Invocation Status
-To check the status of a particular trigger invocation, you can use the
-[list invocation statuses](/idn/api/beta/list-invocation-status) endpoint. The
-status endpoint works for both `REQUEST_RESPONSE` and `FIRE_AND_FORGET`
-triggers. However, the status of `FIRE_AND_FORGET` trigger invocations will
-contain null values in their `completeInvocationInput` since `FIRE_AND_FORGET`
-triggers don't need a response to complete.
+To check the status of a particular trigger invocation, you can use the [list invocation statuses](/idn/api/beta/list-invocation-status) endpoint. The status endpoint works for both `REQUEST_RESPONSE` and `FIRE_AND_FORGET` triggers. However, the status of `FIRE_AND_FORGET` trigger invocations will contain null values in their `completeInvocationInput` since `FIRE_AND_FORGET` triggers don't need a response to complete.
diff --git a/products/idn/docs/identity-now/event-triggers/subscribing-to-a-trigger.md b/products/idn/docs/identity-now/event-triggers/subscribing-to-a-trigger.md
index 748ad03f7..2a7a19a56 100644
--- a/products/idn/docs/identity-now/event-triggers/subscribing-to-a-trigger.md
+++ b/products/idn/docs/identity-now/event-triggers/subscribing-to-a-trigger.md
@@ -5,49 +5,26 @@ pagination_label: Subscribing to a Trigger
sidebar_label: Subscribing to a Trigger
sidebar_position: 3
sidebar_class_name: subscribingToTrigger
-keywords: ["event", "trigger", "subscribing"]
-description:
- Usually, you will subscribe to event triggers using the user interface in IDN.
- Refer to subscribing to event triggers to learn how to subscribe to an event
- trigger through the IDN UI.
+keywords: ['event', 'trigger', 'subscribing']
+description: Usually, you will subscribe to event triggers using the user interface in IDN. Refer to subscribing to event triggers to learn how to subscribe to an event trigger through the IDN UI.
slug: /docs/event-triggers/subscribing-to-trigger
-tags: ["Event Triggers"]
+tags: ['Event Triggers']
---
## View the Available Triggers
-SailPoint is continuously developing new event triggers to satisfy different use
-cases. Some of these triggers are considered **early access** and are only
-available in an IDN tenant upon request. To see a list of available event
-triggers in your tenant, go to the **Event Triggers** tab in the **Admin**
-section of IdentityNow. The first page is a list of your tenant's available
-event triggers. You can select each trigger to learn more about its type, what
-causes it to fire, and what the payload will look like.
+SailPoint is continuously developing new event triggers to satisfy different use cases. Some of these triggers are considered **early access** and are only available in an IDN tenant upon request. To see a list of available event triggers in your tenant, go to the **Event Triggers** tab in the **Admin** section of IdentityNow. The first page is a list of your tenant's available event triggers. You can select each trigger to learn more about its type, what causes it to fire, and what the payload will look like.

## Subscribe to a Trigger from the UI
-Usually, you will subscribe to event triggers using the user interface in IDN.
-Refer to
-[subscribing to event triggers](https://documentation.sailpoint.com/saas/help/common/event_triggers.html#subscribing-to-event-triggers)
-to learn how to subscribe to an event trigger through the IDN UI.
+Usually, you will subscribe to event triggers using the user interface in IDN. Refer to [subscribing to event triggers](https://documentation.sailpoint.com/saas/help/common/event_triggers.html#subscribing-to-event-triggers) to learn how to subscribe to an event trigger through the IDN UI.
## Subscribe to a Trigger from the API
-Sometimes, you may need to use the API to subscribe to event triggers. This can
-occur when you want to programatically subscribe/unsubscribe from event triggers
-in a custom application or no-code solution that does not have a native
-integration with SailPoint.
+Sometimes, you may need to use the API to subscribe to event triggers. This can occur when you want to programatically subscribe/unsubscribe from event triggers in a custom application or no-code solution that does not have a native integration with SailPoint.
-If this is your first time calling a SailPoint API, refer to the
-[getting started guide](../../../api/getting-started.md) to learn how to
-generate a token and call the APIs.
+If this is your first time calling a SailPoint API, refer to the [getting started guide](../../../api/getting-started.md) to learn how to generate a token and call the APIs.
-Start by reviewing the list of
-[available event triggers](/idn/api/beta/triggers#available-event-triggers), and
-take note of the **ID** of the trigger you want to subscribe to (ex
-`idn:access-request-dynamic-approver`). Use the
-[create subscription](/idn/api/beta/create-subscription) endpoint to subscribe
-to an event trigger of your choosing. See the API docs for the latest details
-about how to craft a subscription request.
+Start by reviewing the list of [available event triggers](/idn/api/beta/triggers#available-event-triggers), and take note of the **ID** of the trigger you want to subscribe to (ex `idn:access-request-dynamic-approver`). Use the [create subscription](/idn/api/beta/create-subscription) endpoint to subscribe to an event trigger of your choosing. See the API docs for the latest details about how to craft a subscription request.
diff --git a/products/idn/docs/identity-now/event-triggers/testing-triggers.md b/products/idn/docs/identity-now/event-triggers/testing-triggers.md
index a28998a58..a921e8662 100644
--- a/products/idn/docs/identity-now/event-triggers/testing-triggers.md
+++ b/products/idn/docs/identity-now/event-triggers/testing-triggers.md
@@ -5,41 +5,23 @@ pagination_label: Testing Triggers
sidebar_label: Testing Triggers
sidebar_position: 5
sidebar_class_name: testingTriggers
-keywords: ["event", "trigger", "testing"]
-description:
- It is important to test your trigger subscription configuration with your
- actual subscribing service before enabling your subscription for production
- use.
+keywords: ['event', 'trigger', 'testing']
+description: It is important to test your trigger subscription configuration with your actual subscribing service before enabling your subscription for production use.
slug: /docs/event-triggers/testing-triggers
-tags: ["Event Triggers"]
+tags: ['Event Triggers']
---
-It is important to test your trigger subscription configuration with your actual
-subscribing service (not a test site like [webhook.site](https://webhook.site))
-before enabling your subscription for production use. Testing subscriptions
-ensures that your subscribing service can successfully receive events and that
-you are receiving the correct events based on the filter you have provided.
+It is important to test your trigger subscription configuration with your actual subscribing service (not a test site like [webhook.site](https://webhook.site)) before enabling your subscription for production use. Testing subscriptions ensures that your subscribing service can successfully receive events and that you are receiving the correct events based on the filter you have provided.
## Sending Test Invocations
-The easiest way to send a test event to your subscribing service is to use the
-**Test Subscription** command. Go to your subscription in the Event Trigger UI,
-select **Options** to the right of the subscription, and select **Test
-Subscription**.
+The easiest way to send a test event to your subscribing service is to use the **Test Subscription** command. Go to your subscription in the Event Trigger UI, select **Options** to the right of the subscription, and select **Test Subscription**.

-Doing so sends a test event to your subscribing service, using the default
-example payload for the specific trigger you are subscribing to. This is an easy
-way to validate that your service can receive events, but it lacks the ability
-to modify the event payload to test your filter against different payloads.
-However, there is an API endpoint you can use to modify the test payload.
+Doing so sends a test event to your subscribing service, using the default example payload for the specific trigger you are subscribing to. This is an easy way to validate that your service can receive events, but it lacks the ability to modify the event payload to test your filter against different payloads. However, there is an API endpoint you can use to modify the test payload.
-If you want to control the test input to validate your filter against a more
-robust set of data, you can use the
-[test invocation](/idn/api/beta/start-test-invocation) API endpoint. You can use
-this API to send an input payload with any values that you want. This is an
-example of an invocation of this API:
+If you want to control the test input to validate your filter against a more robust set of data, you can use the [test invocation](/idn/api/beta/start-test-invocation) API endpoint. You can use this API to send an input payload with any values that you want. This is an example of an invocation of this API:
```text
POST `https://{tenant}.api.identitynow.com/beta/trigger-invocations/test`
@@ -79,38 +61,23 @@ POST `https://{tenant}.api.identitynow.com/beta/trigger-invocations/test`
### Trigger Service Issues
-If your subscribing service is not receiving your test invocations, you have a
-couple of options to debug the issue. Start by viewing the activity log for the
-subscription in the UI to ensure your test events are actually being sent.
+If your subscribing service is not receiving your test invocations, you have a couple of options to debug the issue. Start by viewing the activity log for the subscription in the UI to ensure your test events are actually being sent.

-Check the **Created** date with the time you sent the test events. If they are
-being sent, check the event details. Look for any errors being reported, and
-ensure your subscribing service's subscription ID is in the `subcriptionId` the
-event was sent to.
+Check the **Created** date with the time you sent the test events. If they are being sent, check the event details. Look for any errors being reported, and ensure your subscribing service's subscription ID is in the `subcriptionId` the event was sent to.

-You can also view the activity log by using the
-[list latest invocation statuses](/idn/api/beta/list-invocation-status)
-endpoint.
+You can also view the activity log by using the [list latest invocation statuses](/idn/api/beta/list-invocation-status) endpoint.
### Filter Issues
-If you do not see your events in the activity log, it may be a filtering issue.
-If the filter you configured on the subscription is not matching the test event
-data, no event will be sent. Double check your filter expression with the test
-payload in a JSONpath editor to ensure the filter is valid and matches your
-data. See [Filtering Events](./filtering-events.md) for more information.
+If you do not see your events in the activity log, it may be a filtering issue. If the filter you configured on the subscription is not matching the test event data, no event will be sent. Double check your filter expression with the test payload in a JSONpath editor to ensure the filter is valid and matches your data. See [Filtering Events](./filtering-events.md) for more information.
### Misconfigured Subscription
Double check that your subscription configuration is correct.
-- Ensure the URL you provided is accessible from the public internet. If your
- subscribing service is hosted internally in your company's intranet, you may
- be able to access it from your computer, but the trigger service may not be
- able to.
-- Verify that the authentication details are correct. Verify that the
- username/password or bearer token is valid.
+- Ensure the URL you provided is accessible from the public internet. If your subscribing service is hosted internally in your company's intranet, you may be able to access it from your computer, but the trigger service may not be able to.
+- Verify that the authentication details are correct. Verify that the username/password or bearer token is valid.
diff --git a/products/idn/docs/identity-now/event-triggers/trigger-types.md b/products/idn/docs/identity-now/event-triggers/trigger-types.md
index 2f2651a4f..414e865cd 100644
--- a/products/idn/docs/identity-now/event-triggers/trigger-types.md
+++ b/products/idn/docs/identity-now/event-triggers/trigger-types.md
@@ -5,24 +5,15 @@ pagination_label: Trigger Types
sidebar_label: Trigger Types
sidebar_position: 1
sidebar_class_name: triggerTypes
-keywords: ["event", "trigger", "types"]
-description:
- Different types of triggerst exist, and those types of triggers do different
- things depending on their type.
+keywords: ['event', 'trigger', 'types']
+description: Different types of triggerst exist, and those types of triggers do different things depending on their type.
slug: /docs/event-triggers/trigger-types
-tags: ["Event Triggers"]
+tags: ['Event Triggers']
---
## Fire and Forget
-A fire and forget trigger only supports one-way communication with subscribers.
-Its only job is to forward each event it receives to each subscribing service.
-This trigger type does not wait for a response from subscribers. It has no way
-of knowing whether subscribers actually receive the event, and it does not have
-any mechanism for resending events. Think of this trigger type as live
-television. You can only see what is happening in real-time. You cannot rewind
-the live feed or interact with the broadcast in any way. This trigger type is
-the simplest and most common trigger type among SailPoint's event triggers.
+A fire and forget trigger only supports one-way communication with subscribers. Its only job is to forward each event it receives to each subscribing service. This trigger type does not wait for a response from subscribers. It has no way of knowing whether subscribers actually receive the event, and it does not have any mechanism for resending events. Think of this trigger type as live television. You can only see what is happening in real-time. You cannot rewind the live feed or interact with the broadcast in any way. This trigger type is the simplest and most common trigger type among SailPoint's event triggers.
:::caution
@@ -32,14 +23,7 @@ Fire and forget triggers can have a maximum of 50 subscribers per event.
## Request Response
-A request response trigger allows two-way communication between the trigger
-service and the subscriber. The main difference with this trigger type is that
-it expects a response from the subscriber with directions about how to proceed
-with the event. For example, the access request dynamic approval event trigger
-will send the subscriber details about the access request, and the subscriber
-may respond to the trigger with the identity ID to include in the approval
-process for an access request. This trigger type allows subscribers to not only
-receive events in real-time, but to act on them as well.
+A request response trigger allows two-way communication between the trigger service and the subscriber. The main difference with this trigger type is that it expects a response from the subscriber with directions about how to proceed with the event. For example, the access request dynamic approval event trigger will send the subscriber details about the access request, and the subscriber may respond to the trigger with the identity ID to include in the approval process for an access request. This trigger type allows subscribers to not only receive events in real-time, but to act on them as well.
:::caution
diff --git a/products/idn/docs/identity-now/index.mdx b/products/idn/docs/identity-now/index.mdx
index 6b3341b36..057c9c926 100644
--- a/products/idn/docs/identity-now/index.mdx
+++ b/products/idn/docs/identity-now/index.mdx
@@ -8,111 +8,83 @@ sidebar_class_name: IdentityNow
hide_title: true
keywords:
[
- "IdentityNow",
- "development",
- "developer",
- "portal",
- "getting started",
- "docs",
- "documentation",
+ 'IdentityNow',
+ 'development',
+ 'developer',
+ 'portal',
+ 'getting started',
+ 'docs',
+ 'documentation',
]
-description:
- This is the intoduction documentation to development on the IdentityNow
- platform.
+description: This is the intoduction documentation to development on the IdentityNow platform.
slug: /docs
-tags: ["Introduction", "Getting Started"]
+tags: ['Introduction', 'Getting Started']
---
-import Tabs from "@theme/Tabs";
-import TabItem from "@theme/TabItem";
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
-🧭 There are many different ways in which you are able to extend the IdentityNow
-platfrom beyond what comes out of the box. Please, explore our documentation and
-see what is possible! This documentation assumes that you are a current customer
-or partner and already have access to the IdentityNow application.
+🧭 There are many different ways in which you are able to extend the IdentityNow platfrom beyond what comes out of the box. Please, explore our documentation and see what is possible! This documentation assumes that you are a current customer or partner and already have access to the IdentityNow application.
:::info Are you a partner?
-Looking to become a partner? If you are interested in becoming a partner, be it
-an ISV or Channel/Implementation partner,
-[click here](https://www.sailpoint.com/partners/become-partner/).
+Looking to become a partner? If you are interested in becoming a partner, be it an ISV or Channel/Implementation partner, [click here](https://www.sailpoint.com/partners/become-partner/).
:::
## Before You Get Started
-Please read this introduction carefully, as it contains recommendations and
-need-to-know information pertaining to all features of the IdentityNow platform.
+Please read this introduction carefully, as it contains recommendations and need-to-know information pertaining to all features of the IdentityNow platform.
### Authentication
-Many of the interactions you have through our various features will have you
-interacting with our APIs either directly or indirectly. It would be valuable to
-familiarize yourself with [Authentication](../../api/authentication.md) on our
-platform.
+Many of the interactions you have through our various features will have you interacting with our APIs either directly or indirectly. It would be valuable to familiarize yourself with [Authentication](../../api/authentication.md) on our platform.
### Understanding JSON
-JSON (JavaScript Object Notation) is a lightweight data-interchange format. It
-is easy for humans to read and write. It is easy for machines to parse and
-generate. JSON is at the heart of every API and development feature that
-SailPoint offers in IdentityNow—usually either inputs or outputs to/from a
-system.
-[Learn more about JSON here](https://www.w3schools.com/js/js_json_intro.asp).
+JSON (JavaScript Object Notation) is a lightweight data-interchange format. It is easy for humans to read and write. It is easy for machines to parse and generate. JSON is at the heart of every API and development feature that SailPoint offers in IdentityNow—usually either inputs or outputs to/from a system. [Learn more about JSON here](https://www.w3schools.com/js/js_json_intro.asp).
### Understanding Webhooks
-A webhook in web development is a method of augmenting or altering the behavior
-of a web page or web application with custom callbacks. These callbacks may be
-maintained, modified, and managed by third-party users and developers who may
-not necessarily be affiliated with the originating website or application. Our
-[Event Triggers](docs/event-triggers) are a form of webhook, for example.
-[Learn more about webhooks here](https://zapier.com/blog/what-are-webhooks/).
+A webhook in web development is a method of augmenting or altering the behavior of a web page or web application with custom callbacks. These callbacks may be maintained, modified, and managed by third-party users and developers who may not necessarily be affiliated with the originating website or application. Our [Event Triggers](docs/event-triggers) are a form of webhook, for example. [Learn more about webhooks here](https://zapier.com/blog/what-are-webhooks/).
## Recommended Technologies
-While you can use whichever development tools you are most comfortable with or
-find most useful, we will recommend tools here for those that are new to
-development.
+While you can use whichever development tools you are most comfortable with or find most useful, we will recommend tools here for those that are new to development.
:::tip
-Our team, when developing documentation, example code/applications, videos, etc.
-will almost always use one of the tools listed below. We will soon add
-programming languages to this list!
+Our team, when developing documentation, example code/applications, videos, etc. will almost always use one of the tools listed below. We will soon add programming languages to this list!
:::
### IDEs (Integrated Development Environments)
-IDEs are great for consolidating different aspects of programming into one tool.
-They're great for not only writing code, but managing your code as well. While
-you can use any IDE you feel is best fit for you and the task, here is what we
-use:
+IDEs are great for consolidating different aspects of programming into one tool. They're great for not only writing code, but managing your code as well. While you can use any IDE you feel is best fit for you and the task, here is what we use:
-| IDE | Description |
-| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| [VS Code](https://code.visualstudio.com/) | VS Code is a lightweight IDE that we believe is perfect for development on our IdentityNow platform. We also have great plug-in support from our community, like [this one](https://marketplace.visualstudio.com/items?itemName=yannick-beot-sp.vscode-sailpoint-identitynow)! |
-| [IntelliJ](https://www.jetbrains.com/idea/) | If you happen to be writing in Java or developing Rules on our platform, we typically recommend IntelliJ. While Java development can be done in VS Code, you will have an easier time using an IDE that was purpose-built for Java. |
+| IDE | Description |
+| --- | --- |
+| [VS Code](https://code.visualstudio.com/) | VS Code is a lightweight IDE that we believe is perfect for development on our IdentityNow platform. We also have great plug-in support from our community, like [this one](https://marketplace.visualstudio.com/items?itemName=yannick-beot-sp.vscode-sailpoint-identitynow)! |
+| [IntelliJ](https://www.jetbrains.com/idea/) | If you happen to be writing in Java or developing Rules on our platform, we typically recommend IntelliJ. While Java development can be done in VS Code, you will have an easier time using an IDE that was purpose-built for Java. |
-| IDE | Description |
-| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| [VS Code](https://code.visualstudio.com/) | VS Code is a lightweight IDE that we believe is perfect for development on our IdentityNow platform. We also have great plug-in support from our community, like [this one](https://marketplace.visualstudio.com/items?itemName=yannick-beot-sp.vscode-sailpoint-identitynow)! |
-| [IntelliJ](https://www.jetbrains.com/idea/) | If you happen to be writing in Java or developing Rules on our platform, we typically recommend IntelliJ. While Java development can be done in VS Code, you will have an easier time using an IDE that was purpose-built for Java. |
+| IDE | Description |
+| --- | --- |
+| [VS Code](https://code.visualstudio.com/) | VS Code is a lightweight IDE that we believe is perfect for development on our IdentityNow platform. We also have great plug-in support from our community, like [this one](https://marketplace.visualstudio.com/items?itemName=yannick-beot-sp.vscode-sailpoint-identitynow)! |
+| [IntelliJ](https://www.jetbrains.com/idea/) | If you happen to be writing in Java or developing Rules on our platform, we typically recommend IntelliJ. While Java development can be done in VS Code, you will have an easier time using an IDE that was purpose-built for Java. |
-| IDE | Description |
-| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| [VS Code](https://code.visualstudio.com/) | VS Code is a lightweight IDE that we believe is perfect for development on our IdentityNow platform. We also have great plug-in support from our community, like [this one](https://marketplace.visualstudio.com/items?itemName=yannick-beot-sp.vscode-sailpoint-identitynow)! |
-| [IntelliJ](https://www.jetbrains.com/idea/) | If you happen to be writing in Java or developing Rules on our platform, we typically recommend IntelliJ. While Java development can be done in VS Code, you will have an easier time using an IDE that was purpose-built for Java. |
+| IDE | Description |
+| --- | --- |
+| [VS Code](https://code.visualstudio.com/) | VS Code is a lightweight IDE that we believe is perfect for development on our IdentityNow platform. We also have great plug-in support from our community, like [this one](https://marketplace.visualstudio.com/items?itemName=yannick-beot-sp.vscode-sailpoint-identitynow)! |
+| [IntelliJ](https://www.jetbrains.com/idea/) | If you happen to be writing in Java or developing Rules on our platform, we typically recommend IntelliJ. While Java development can be done in VS Code, you will have an easier time using an IDE that was purpose-built for Java. |
@@ -121,16 +93,14 @@ use:
### CLI Environments
-When interacting with our platform or writing code related to IdentityNow, we
-often use the CLI. While you can use any CLI that you feel is best fit for you
-and your job, here are the CLI environments we use and recommend:
+When interacting with our platform or writing code related to IdentityNow, we often use the CLI. While you can use any CLI that you feel is best fit for you and your job, here are the CLI environments we use and recommend:
-| CLI Tool | Description |
-| -------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Windows PowerShell | Windows PowerShell is a modern terminal on windows (also available on Mac/Linux) that offers versatile CLI, task automation, and configuration management options. |
+| CLI Tool | Description |
+| --- | --- |
+| Windows PowerShell | Windows PowerShell is a modern terminal on windows (also available on Mac/Linux) that offers versatile CLI, task automation, and configuration management options. |
| [Windows Terminal](https://apps.microsoft.com/store/detail/windows-terminal/9N0DX20HK701?hl=en-us&gl=us) | The Windows Terminal is a modern, fast, efficient, powerful, and productive terminal application for users of command-line tools and shells like Command Prompt, PowerShell, and WSL. Its main features include multiple tabs, panes, Unicode and UTF-8 character support, a GPU accelerated text rendering engine, and custom themes, styles, and configurations. Terminal is just a more beautiful version of PowerShell 😁 |
@@ -143,8 +113,8 @@ and your job, here are the CLI environments we use and recommend:
-| CLI Tool | Description |
-| ------------------------ | -------------------------------------------------- |
+| CLI Tool | Description |
+| --- | --- |
| Linux Terminal (default) | On Linux, we recommend using the default terminal. |
@@ -154,31 +124,23 @@ and your job, here are the CLI environments we use and recommend:
### Version Control
-Writing code typically requires version control to adequately track changes in
-sets of files. While you can use any version control that you feel is best fit
-for you and your job, here are the version control tools that we use and
-recommend:
+Writing code typically requires version control to adequately track changes in sets of files. While you can use any version control that you feel is best fit for you and your job, here are the version control tools that we use and recommend:
-| Version Control Tool | Description |
-| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [git](https://git-scm.com/) | Git is a free and open-source, distributed version control system designed to handle everything from small to very large projects. Git runs locally on your machine. |
+| Version Control Tool | Description |
+| --- | --- |
+| [git](https://git-scm.com/) | Git is a free and open-source, distributed version control system designed to handle everything from small to very large projects. Git runs locally on your machine. |
| [GitHub](https://github.com) | GitHub is an internet hosting service for managing git in the cloud. We use GitHub on our team to collaborate amongst the other developers on our team, as well as with our community. |
---
### API Clients
-API clients make it easy to call APIs without having to first write code. API
-clients are great for testing and getting familiar with APIs to get a better
-understanding of what the inputs/outputs are and how they work.
+API clients make it easy to call APIs without having to first write code. API clients are great for testing and getting familiar with APIs to get a better understanding of what the inputs/outputs are and how they work.
-| API Client | Description |
-| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| API Client | Description |
+| --- | --- |
| [Postman](https://www.postman.com/downloads/) | Postman is an API platform for building and using APIs. Postman simplifies each step of the API lifecycle and streamlines collaboration so you can create better APIs—faster. |
## Glossary
-Identity is a complex topic and there are many terms used, and quite often!
-Please
-[refer to our glossary](https://documentation.sailpoint.com/saas/help/common/glossary.html)
-whenever possible if you aren't sure what something means.
+Identity is a complex topic and there are many terms used, and quite often! Please [refer to our glossary](https://documentation.sailpoint.com/saas/help/common/glossary.html) whenever possible if you aren't sure what something means.
diff --git a/products/idn/docs/identity-now/rules/cloud-rules/account_profile_attribute_generator.md b/products/idn/docs/identity-now/rules/cloud-rules/account_profile_attribute_generator.md
index c301d2588..675a62964 100644
--- a/products/idn/docs/identity-now/rules/cloud-rules/account_profile_attribute_generator.md
+++ b/products/idn/docs/identity-now/rules/cloud-rules/account_profile_attribute_generator.md
@@ -4,38 +4,32 @@ title: Account Profile Attribute Generator
pagination_label: Account Profile Attribute Generator
sidebar_label: Account Profile Attribute Generator
sidebar_class_name: accountProfileAttributeGenerator
-keywords: ["cloud", "rules", "account profile", "attribute generator"]
-description:
- This rule generates complex account attribute values during provisioning, e.g. when
- creating an account.
+keywords: ['cloud', 'rules', 'account profile', 'attribute generator']
+description: This rule generates complex account attribute values during provisioning, e.g. when creating an account.
slug: /docs/rules/cloud-rules/account-profile-attribute-generator
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
-This rule generates complex account attribute values during provisioning, e.g. when creating an account.
-You would typically use this rule when you are creating an account to generate attributes like usernames.
+This rule generates complex account attribute values during provisioning, e.g. when creating an account. You would typically use this rule when you are creating an account to generate attributes like usernames.
## Execution
-- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has
- read-only access to IdentityNow data models, but it does not have access to
- on-premise sources or connectors.
-- **Logging** - Logging statements are currently only visible to SailPoint
- personnel.
+- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has read-only access to IdentityNow data models, but it does not have access to on-premise sources or connectors.
+- **Logging** - Logging statements are currently only visible to SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
-| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
-| identity | sailpoint.object.Identity | Reference to identity object representing the identity being calculated. |
-| application | java.lang.Object | Attribute value of the identity attribute before the rule runs. |
-| field | sailpoint.object.Field | Field object used to get information about the attribute being generated. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
+| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
+| identity | sailpoint.object.Identity | Reference to identity object representing the identity being calculated. |
+| application | java.lang.Object | Attribute value of the identity attribute before the rule runs. |
+| field | sailpoint.object.Field | Field object used to get information about the attribute being generated. |
## Output
diff --git a/products/idn/docs/identity-now/rules/cloud-rules/account_profile_attribute_generator_from_template.md b/products/idn/docs/identity-now/rules/cloud-rules/account_profile_attribute_generator_from_template.md
index f82309082..26715443e 100644
--- a/products/idn/docs/identity-now/rules/cloud-rules/account_profile_attribute_generator_from_template.md
+++ b/products/idn/docs/identity-now/rules/cloud-rules/account_profile_attribute_generator_from_template.md
@@ -4,40 +4,33 @@ title: Account Profile Attribute Generator (from Template)
pagination_label: Account Profile Attribute Generator (from Template)
sidebar_label: Account Profile Attribute Generator (from Template)
sidebar_class_name: accountProfileAttributeGeneratorTemplate
-keywords: ["cloud", "rules", "account profile", "attribute generator"]
-description:
- This rule generates complex account attribute values during provisioning, e.g. when
- creating an account. The rule's configuration comes from a template of values.
+keywords: ['cloud', 'rules', 'account profile', 'attribute generator']
+description: This rule generates complex account attribute values during provisioning, e.g. when creating an account. The rule's configuration comes from a template of values.
slug: /docs/rules/cloud-rules/account-profile-attribute-generator-template
-tags: ["Rules"]
+tags: ['Rules']
---
# Account Profile Attribute Generator (from Template)
## Overview
-This rule generates complex account attribute values during provisioning, e.g. when creating an account.
-The rule's configuration comes from a template of values.
-You would typically use this rule when you are creating an account to generate attributes like usernames.
+This rule generates complex account attribute values during provisioning, e.g. when creating an account. The rule's configuration comes from a template of values. You would typically use this rule when you are creating an account to generate attributes like usernames.
## Execution
-- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has
- read-only access to IdentityNow data models, but it does not have access to
- on-premise sources or connectors.
-- **Logging** - Logging statements are currently only visible to SailPoint
- personnel.
+- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has read-only access to IdentityNow data models, but it does not have access to on-premise sources or connectors.
+- **Logging** - Logging statements are currently only visible to SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| -------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
-| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
-| identity | sailpoint.object.Identity | Reference to identity object representing the identity being calculated. |
-| field | sailpoint.object.Field | Field object used to get information about the attribute being generated. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
+| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
+| identity | sailpoint.object.Identity | Reference to identity object representing the identity being calculated. |
+| field | sailpoint.object.Field | Field object used to get information about the attribute being generated. |
## Output
diff --git a/products/idn/docs/identity-now/rules/cloud-rules/before_provisioning_rule.md b/products/idn/docs/identity-now/rules/cloud-rules/before_provisioning_rule.md
index 5c4cdb038..865637b39 100644
--- a/products/idn/docs/identity-now/rules/cloud-rules/before_provisioning_rule.md
+++ b/products/idn/docs/identity-now/rules/cloud-rules/before_provisioning_rule.md
@@ -4,35 +4,30 @@ title: Before Provisioning Rule
pagination_label: Before Provisioning Rule
sidebar_label: Before Provisioning Rule
sidebar_class_name: beforeProvisioningRule
-keywords: ["cloud", "rules", "before provisioning"]
+keywords: ['cloud', 'rules', 'before provisioning']
description: This rule runs before provisioning to a source.
slug: /docs/rules/cloud-rules/before-provisioning-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
-Use this rule to modify a provisioning plan as provisioning is sent out.
-Do not use this rule to create new attributes. Use an account
-creation profile (provisioning policy) instead.
+Use this rule to modify a provisioning plan as provisioning is sent out. Do not use this rule to create new attributes. Use an account creation profile (provisioning policy) instead.
## Execution
-- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has
- read-only access to IdentityNow data models, but it does not have access to
- on-premise sources or connectors.
-- **Logging** - Logging statements are currently only visible to SailPoint
- personnel.
+- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has read-only access to IdentityNow data models, but it does not have access to on-premise sources or connectors.
+- **Logging** - Logging statements are currently only visible to SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------- | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
-| plan | sailpoint.object.ProvisioningPlan | Reference to identity object representing the identity being calculated. |
-| application | java.lang.Object | Attribute value for the identity attribute before the rule runs. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
+| plan | sailpoint.object.ProvisioningPlan | Reference to identity object representing the identity being calculated. |
+| application | java.lang.Object | Attribute value for the identity attribute before the rule runs. |
> Note: Logs are not supported for BeforeProvisioning rules.
diff --git a/products/idn/docs/identity-now/rules/cloud-rules/correlation_rule.md b/products/idn/docs/identity-now/rules/cloud-rules/correlation_rule.md
index ff8b4e904..181fa9e14 100644
--- a/products/idn/docs/identity-now/rules/cloud-rules/correlation_rule.md
+++ b/products/idn/docs/identity-now/rules/cloud-rules/correlation_rule.md
@@ -4,12 +4,10 @@ title: Correlation Rule
pagination_label: Correlation Rule
sidebar_label: Correlation Rule
sidebar_class_name: Correlation Rule
-keywords: ["cloud", "rules", "correlation"]
-description:
- This rule associates or correlates an account to an identity, based on
- complex logic.
+keywords: ['cloud', 'rules', 'correlation']
+description: This rule associates or correlates an account to an identity, based on complex logic.
slug: /docs/rules/cloud-rules/correlation-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
@@ -18,26 +16,23 @@ This rule associates or correlates an account to an identity, based on complex l
## Execution
-- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has
- read-only access to IdentityNow data models, but it does not have access to
- on-premise sources or connectors.
-- **Logging** - Logging statements are currently only visible to SailPoint
- personnel.
+- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has read-only access to IdentityNow data models, but it does not have access to on-premise sources or connectors.
+- **Logging** - Logging statements are currently only visible to SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| -------- | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
-| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
-| account | sailpoint.object.ResourceObject | Read-only representation of account data that has been aggregated. Use this as a basis to determine correlation linkages with a specific identity. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
+| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
+| account | sailpoint.object.ResourceObject | Read-only representation of account data that has been aggregated. Use this as a basis to determine correlation linkages with a specific identity. |
## Output
-| Argument | Type | Purpose |
-| --------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Argument | Type | Purpose |
+| --- | --- | --- |
| returnMap | java.util.Map | Map object containing a reference to the identity attributes to correlate to. These should contain both `identityAttributeName` and `identityAttributeValue` as keys. |
## Template
diff --git a/products/idn/docs/identity-now/rules/cloud-rules/generic_rule.md b/products/idn/docs/identity-now/rules/cloud-rules/generic_rule.md
index bb77436c4..3e95933a5 100644
--- a/products/idn/docs/identity-now/rules/cloud-rules/generic_rule.md
+++ b/products/idn/docs/identity-now/rules/cloud-rules/generic_rule.md
@@ -4,10 +4,10 @@ title: Generic Rule
pagination_label: Generic Rule
sidebar_label: Generic Rule
sidebar_class_name: Generic Rule
-keywords: ["cloud", "rules", "generic"]
+keywords: ['cloud', 'rules', 'generic']
description: This rule performs transforms.
slug: /docs/rules/cloud-rules/generic-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
@@ -16,26 +16,23 @@ This rule performs transforms.
## Execution
-- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has
- read-only access to IdentityNow data models, but it does not have access to
- on-premise sources or connectors.
-- **Logging** - Logging statements are currently only visible to SailPoint
- personnel.
+- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has read-only access to IdentityNow data models, but it does not have access to on-premise sources or connectors.
+- **Logging** - Logging statements are currently only visible to SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| -------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
-| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
+| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
## Output
-| Argument | Type | Purpose |
-| -------- | ---------------- | ------------------------------------------------------------- |
-| value | java.lang.Object | Value returned for the account attribute, typically a string. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| value | java.lang.Object | Value returned for the account attribute, typically a string. |
## Template
@@ -54,8 +51,7 @@ This rule performs transforms.
## Example - Name Normalizer
-This rule normalizes any names into normal names capitaliztion. For
-example: JOHN DOE -> John Doe.
+This rule normalizes any names into normal names capitaliztion. For example: JOHN DOE -> John Doe.
```java
diff --git a/products/idn/docs/identity-now/rules/cloud-rules/identity_attribute_rule.md b/products/idn/docs/identity-now/rules/cloud-rules/identity_attribute_rule.md
index d4b27e1e9..672a37cd5 100644
--- a/products/idn/docs/identity-now/rules/cloud-rules/identity_attribute_rule.md
+++ b/products/idn/docs/identity-now/rules/cloud-rules/identity_attribute_rule.md
@@ -4,44 +4,38 @@ title: Identity Attribute Rule
pagination_label: Identity Attribute Rule
sidebar_label: Identity Attribute Rule
sidebar_class_name: identityAttributeRule
-keywords: ["cloud", "rules", "identity attribute"]
-description:
- This rule calculates and returns an identity attribute for a specific
- identity.
+keywords: ['cloud', 'rules', 'identity attribute']
+description: This rule calculates and returns an identity attribute for a specific identity.
slug: /docs/rules/cloud-rules/identity-attribute-rule
-tags: ["Rules"]
+tags: ['Rules']
---
# Identity Attribute Rule
## Overview
-This rule calculates and returns an identity attribute for a specific identity.
-This rule is also known as a "complex" rule on the identity profile.
+This rule calculates and returns an identity attribute for a specific identity. This rule is also known as a "complex" rule on the identity profile.
## Execution
-- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has
- read-only access to IdentityNow data models, but it does not have access to
- on-premise sources or connectors.
-- **Logging** - Logging statements are currently only visible to SailPoint
- personnel.
+- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has read-only access to IdentityNow data models, but it does not have access to on-premise sources or connectors.
+- **Logging** - Logging statements are currently only visible to SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| -------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
-| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
-| identity | sailpoint.object.Identity | Reference to identity object representing the identity being calculated. |
-| oldValue | java.lang.Object | Attribute value for the identity attribute before the rule runs. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
+| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
+| identity | sailpoint.object.Identity | Reference to identity object representing the identity being calculated. |
+| oldValue | java.lang.Object | Attribute value for the identity attribute before the rule runs. |
## Output
-| Argument | Type | Purpose |
-| -------------- | ---------------- | ------------------------------------------ |
+| Argument | Type | Purpose |
+| --- | --- | --- |
| attributeValue | java.lang.Object | Value returned for the identity attribute. |
## Template
diff --git a/products/idn/docs/identity-now/rules/cloud-rules/index.md b/products/idn/docs/identity-now/rules/cloud-rules/index.md
index a67b1419b..de41a8aaa 100644
--- a/products/idn/docs/identity-now/rules/cloud-rules/index.md
+++ b/products/idn/docs/identity-now/rules/cloud-rules/index.md
@@ -5,23 +5,17 @@ pagination_label: Cloud Executed Rules
sidebar_label: Cloud Executed Rules
sidebar_position: 1
sidebar_class_name: cloudExecutedRules
-keywords: ["cloud", "rules"]
+keywords: ['cloud', 'rules']
description: Overview of cloud-executed rules
slug: /docs/rules/cloud-rules
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
-**Cloud-Executed Rules** or **Cloud Rules** typically only perform a
-specific function, such as calculating attribute values.
-Cloud Rules all execute within the SailPoint cloud and offer access to
-objects and data, but they do not offer any sort of externalized
-connectivity.
+**Cloud-Executed Rules** or **Cloud Rules** typically only perform a specific function, such as calculating attribute values. Cloud Rules all execute within the SailPoint cloud and offer access to objects and data, but they do not offer any sort of externalized connectivity.
-Because these rules execute in a multi-tenant cloud environment, they have a very
-restricted context, and the review process is carefully scrutinized to ensure
-that they execute in an efficient and secure manner.
+Because these rules execute in a multi-tenant cloud environment, they have a very restricted context, and the review process is carefully scrutinized to ensure that they execute in an efficient and secure manner.
## Supported Cloud Rules
@@ -34,23 +28,13 @@ import {useCurrentSidebarCategory} from '@docusaurus/theme-common';
## Configuration Process
-To ensure maximum compatibility, platform integrity, and security, SailPoint has
-instantiated a review process to ensure that any submitted Cloud Rules meet SailPoint
-requirements and that they do not contain code that can harm the system.
-The review process also checks the rules to verify their intended purposes and use cases.
+To ensure maximum compatibility, platform integrity, and security, SailPoint has instantiated a review process to ensure that any submitted Cloud Rules meet SailPoint requirements and that they do not contain code that can harm the system. The review process also checks the rules to verify their intended purposes and use cases.
-In this process, SailPoint does _not check_ whether the rule executes correctly
-or verify that it works as expected to deliver specific outcomes. The review is merely
-an integrity check on the rule itself.
+In this process, SailPoint does _not check_ whether the rule executes correctly or verify that it works as expected to deliver specific outcomes. The review is merely an integrity check on the rule itself.
## Submitting for Rule Review
-To submit your Cloud Rule for review, approval, and inclusion in the
-SailPoint platform, submit them with
-[SailPoint Professional Services](https://www.sailpoint.com/services/professional/).
-If you need help writing and testing rules, Professional Services can help you with
-that process as well. Make sure your contact information is up to date,
-in case the review team needs to contact you.
+To submit your Cloud Rule for review, approval, and inclusion in the SailPoint platform, submit them with [SailPoint Professional Services](https://www.sailpoint.com/services/professional/). If you need help writing and testing rules, Professional Services can help you with that process as well. Make sure your contact information is up to date, in case the review team needs to contact you.
## Review Guidelines
@@ -58,20 +42,14 @@ All submitted rules must follow proper rule submission guidelines.
- **Best Practices**
- Ensure that all rule configurations are complete and accurate.
- - Check whether your rule follows SailPoint best practice guidance, and ensure that you have
- considered other product features first.
+ - Check whether your rule follows SailPoint best practice guidance, and ensure that you have considered other product features first.
- **Rule Quality**
- - Rules must follow the [Rule Guidelines](../index.md#rule-guidelines)
- and [Code Restrictions](../index.md#rule-code-restrictions)
+ - Rules must follow the [Rule Guidelines](../index.md#rule-guidelines) and [Code Restrictions](../index.md#rule-code-restrictions)
- Rules must be adequately tested prior to submission.
- **Documentation**
- - Include detailed comments for non-obvious features in the configurations,
- including supporting documentation where appropriate. This includes
- justification for why something was created or done in a certain way. -
- _e.g. I did this because..._
+ - Include detailed comments for non-obvious features in the configurations, including supporting documentation where appropriate. This includes justification for why something was created or done in a certain way. - _e.g. I did this because..._
- **Standards**
- - Rules must omit commented out blocks or unfinished, incomplete, or untested
- code.
+ - Rules must omit commented out blocks or unfinished, incomplete, or untested code.
- Rules must be submitted with appropriate UTF-8 encoding.
- Rules must convert url-encoded characters:
- `&` should be `&`
@@ -89,62 +67,34 @@ This should be your file name:
`Rule - IdentityAttribute - Calculate Lifecycle.xml`
-If you do not have a type, use "Generic" as the type. It would look
-like this:
+If you do not have a type, use "Generic" as the type. It would look like this:
`Rule - Generic - My Generic Rule.xml`
- **Updating Existing Rules and Versioning**
- - The best practice is to maintain a single rule for a given use case in the
- tenant. Creating additional rules while updating to maintain versioning is
- not supported because doing so may cause issues during reviews and support.
- - **Example:** For an AD Before Provisioning rule called "AD
- BeforeProvisioningRule", you have the file "Rule - BeforeProvisioning -
- AD BeforeProvisioningRule.xml". When you are updating the logic for AD, it is best
- to update the file/rule with the same name, so changes can be properly
- tracked to the single object.
+ - The best practice is to maintain a single rule for a given use case in the tenant. Creating additional rules while updating to maintain versioning is not supported because doing so may cause issues during reviews and support.
+ - **Example:** For an AD Before Provisioning rule called "AD BeforeProvisioningRule", you have the file "Rule - BeforeProvisioning - AD BeforeProvisioningRule.xml". When you are updating the logic for AD, it is best to update the file/rule with the same name, so changes can be properly tracked to the single object.
- **Deployment Window Requirements**
- - Rules are generally reviewed and deployed, if they are accepted
- without feedback, within 24 hours.
- - If specific windows are required and you want full control of when a rule
- is updated, use these steps to follow the versioning best practices:
+ - Rules are generally reviewed and deployed, if they are accepted without feedback, within 24 hours.
+ - If specific windows are required and you want full control of when a rule is updated, use these steps to follow the versioning best practices:
- Submit your request for a new rule with the name: `-TEMP`
- Apply the new rule during the change window.
- Validate the updated rule logic.
- Once the rule is validated, submit your request to update original rule with the updated logic.
- - Once the original rule is updated, apply the original rule as the production
- configuration.
+ - Once the original rule is updated, apply the original rule as the production configuration.
- Submit your request to delete the TEMP rule.
## Review Expectations
Once you have submitted your rule and you are in the review process, remember these points:
-- **Timing:** SailPoint will examine your rule as soon as possible. Most rules are
- reviewed within 24 hours of submission. However, if your rule is complex,
- poorly documented, hard to read, or if it presents new issues, it may require
- greater scrutiny and consideration. If your rule is repeatedly rejected for
- the same guideline violation, your rule's review may take longer to complete.
-- **Status Updates:** Your rule's current status will be reflected in your
- [SailPoint Expert Services request](https://www.sailpoint.com/services/professional/#contact-form),
- so you can monitor its progress there.
-- **Expedite Requests:** If you have a critical timing issue, you can request an
- expedited review. Respect your fellow implementers by seeking expedited
- review only when you truly need it. If you are found to be abusing this system, SailPoint
- may reject further requests going forward.
-- **Rejections:** SailPoint's goal is to apply these guidelines fairly and consistently,
- but mistaken rejections can happen. If your rule has been rejected and you have questions or you
- would like to provide additional information, communicate directly with
- the rule review team. This may help get your rule into IdentityNow, and it can
- help SailPoint improve the process or identify a need for clarity in its policies. If
- you still disagree with the outcome, let SailPoint know and someone can look into it.
-- **Changes:** Rule changes or modifications to meet guidelines are not the reviewer's
- responsibility. They are the responsibility of the person(s) submitting the rule.
- Reviewers may give advice, examples, etc. to
- help, but doing so does not guarantee a solution. You should test the rules with the changes
- before resubmission.
+- **Timing:** SailPoint will examine your rule as soon as possible. Most rules are reviewed within 24 hours of submission. However, if your rule is complex, poorly documented, hard to read, or if it presents new issues, it may require greater scrutiny and consideration. If your rule is repeatedly rejected for the same guideline violation, your rule's review may take longer to complete.
+- **Status Updates:** Your rule's current status will be reflected in your [SailPoint Expert Services request](https://www.sailpoint.com/services/professional/#contact-form), so you can monitor its progress there.
+- **Expedite Requests:** If you have a critical timing issue, you can request an expedited review. Respect your fellow implementers by seeking expedited review only when you truly need it. If you are found to be abusing this system, SailPoint may reject further requests going forward.
+- **Rejections:** SailPoint's goal is to apply these guidelines fairly and consistently, but mistaken rejections can happen. If your rule has been rejected and you have questions or you would like to provide additional information, communicate directly with the rule review team. This may help get your rule into IdentityNow, and it can help SailPoint improve the process or identify a need for clarity in its policies. If you still disagree with the outcome, let SailPoint know and someone can look into it.
+- **Changes:** Rule changes or modifications to meet guidelines are not the reviewer's responsibility. They are the responsibility of the person(s) submitting the rule. Reviewers may give advice, examples, etc. to help, but doing so does not guarantee a solution. You should test the rules with the changes before resubmission.
```
diff --git a/products/idn/docs/identity-now/rules/cloud-rules/manager_correlation_rule.md b/products/idn/docs/identity-now/rules/cloud-rules/manager_correlation_rule.md
index 6d93d128f..8c667a452 100644
--- a/products/idn/docs/identity-now/rules/cloud-rules/manager_correlation_rule.md
+++ b/products/idn/docs/identity-now/rules/cloud-rules/manager_correlation_rule.md
@@ -4,10 +4,10 @@ title: Manager Correlation Rule
pagination_label: Manager Correlation Rule
sidebar_label: Manager Correlation Rule
sidebar_class_name: managerCorrelationRule
-keywords: ["cloud", "rules", "manager correlation"]
+keywords: ['cloud', 'rules', 'manager correlation']
description: This rule calculates a manager relationship between identities.
slug: /docs/rules/cloud-rules/manager-correlation-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
@@ -16,27 +16,24 @@ This rule calculates a manager relationship between identities.
## Execution
-- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has
- read-only access to IdentityNow data models, but it does not have access to
- on-premise sources or connectors.
-- **Logging** - Logging statements are currently only visible to SailPoint
- personnel.
+- **Cloud Execution** - This rule executes in the IdentityNow cloud, and it has read-only access to IdentityNow data models, but it does not have access to on-premise sources or connectors.
+- **Logging** - Logging statements are currently only visible to SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| --------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
-| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
-| link | sailpoint.object.Link | Read-only representation of account data that has been aggregated. Use this as a basis to determine manager linkages to a specific manager identity. |
-| managerAttributeValue | java.lang.Object | Attribute value stored in the manager attribute. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| log | org.apache.log4j.Logger | Logger to log statements. _Note: This executes in the cloud, and logging is currently not exposed to anyone other than SailPoint._ |
+| idn | sailpoint.server.IdnRuleUtil | Provides a read-only starting point for using the SailPoint API. From this passed reference, the rule can interrogate the IdentityNow data model including identities or account information via helper methods as described in [IdnRuleUtil](../idn_rule_utility.md). |
+| link | sailpoint.object.Link | Read-only representation of account data that has been aggregated. Use this as a basis to determine manager linkages to a specific manager identity. |
+| managerAttributeValue | java.lang.Object | Attribute value stored in the manager attribute. |
## Output
-| Argument | Type | Purpose |
-| --------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Argument | Type | Purpose |
+| --- | --- | --- |
| returnMap | java.util.Map | Map object containing a reference to the identity attributes to identify the manager's identity. These should contain both `identityAttributeName` and `identityAttributeValue` as keys. |
## Template
diff --git a/products/idn/docs/identity-now/rules/connector-rules/before_after_operation_rule.md b/products/idn/docs/identity-now/rules/connector-rules/before_after_operation_rule.md
index 5f12245df..79b8aae32 100644
--- a/products/idn/docs/identity-now/rules/connector-rules/before_after_operation_rule.md
+++ b/products/idn/docs/identity-now/rules/connector-rules/before_after_operation_rule.md
@@ -4,11 +4,10 @@ title: Before and After Operations on Source Account Rule
pagination_label: Before and After Operations
sidebar_label: Before and After Rule Operations
sidebar_class_name: beforeAndAfterRuleOperations
-keywords: ["cloud", "rules"]
-description: This rule executes PowerShell commands on the IQService component
- after a source account has an operation performed on it.
+keywords: ['cloud', 'rules']
+description: This rule executes PowerShell commands on the IQService component after a source account has an operation performed on it.
slug: /docs/rules/connector-rules/before-and-after-rule-operations
-tags: ["Rules"]
+tags: ['Rules']
---
# Before and After Operations on Source Account Rule
@@ -19,49 +18,37 @@ This rule executes PowerShell commands on the IQService component after a source
The following operations can be performed on a source:
-| Rule Name | Rule Type | Source Type(s) | Purpose |
-| -------------------- | --------------------- | ---------------------------------------- | -------------------------------------------------------------------------------------------- |
-| Before Creation Rule | ConnectorBeforeCreate | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is created. |
-| Before Modify Rule | ConnectorBeforeModify | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is modified. |
-| Before Delete Rule | ConnectorBeforeDelete | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is deleted. |
-| After Creation Rule | ConnectorAfterCreate | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is created. |
-| After Modify Rule | ConnectorAfterModify | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is modified. |
-| After Delete Rule | ConnectorAfterDelete | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is deleted. |
+| Rule Name | Rule Type | Source Type(s) | Purpose |
+| --- | --- | --- | --- |
+| Before Creation Rule | ConnectorBeforeCreate | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is created. |
+| Before Modify Rule | ConnectorBeforeModify | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is modified. |
+| Before Delete Rule | ConnectorBeforeDelete | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is deleted. |
+| After Creation Rule | ConnectorAfterCreate | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is created. |
+| After Modify Rule | ConnectorAfterModify | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is modified. |
+| After Delete Rule | ConnectorAfterDelete | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is deleted. |
## Execution
-- **Connector Execution** - This rule executes within the virtual appliance. It
- may offer special abilities to perform connector-related functions, and it may
- offer managed connections to sources.
-- **Logging** - Logging statements are viewable within the ccg.log on the
- virtual appliance, and they are viewable by SailPoint personnel.
+- **Connector Execution** - This rule executes within the virtual appliance. It may offer special abilities to perform connector-related functions, and it may offer managed connections to sources.
+- **Logging** - Logging statements are viewable within the ccg.log on the virtual appliance, and they are viewable by SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------- | -------------------------------------- | -------------------------------------------------------------------------- |
-| Application | System.Collections.Hashtable | Map of the application configuration. |
-| Request | SailPoint.Utils.objects.AccountRequest | Reference to the account request provisioning instructions. |
-| Result | SailPoint.Utils.objects.ServiceResult | Reference to the provisioning result that can be manipulated if necessary. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| Application | System.Collections.Hashtable | Map of the application configuration. |
+| Request | SailPoint.Utils.objects.AccountRequest | Reference to the account request provisioning instructions. |
+| Result | SailPoint.Utils.objects.ServiceResult | Reference to the provisioning result that can be manipulated if necessary. |
## Architecture Best Practices
-For supportability, it is recommended that you write these operation rules with
-only the most basic logic necessary to trigger a PowerShell script and shift
-the bulk of the downstream events and/or modifications to the PowerShell script
-itself. This script would reside on the client's servers and can therefore be
-easily maintained or modified by the client as needed. It also allows the client
-to implement changes to the PowerShell scripted functionality without requiring
-code review by SailPoint because the code runs outside of the IdentityNow platform.
+For supportability, it is recommended that you write these operation rules with only the most basic logic necessary to trigger a PowerShell script and shift the bulk of the downstream events and/or modifications to the PowerShell script itself. This script would reside on the client's servers and can therefore be easily maintained or modified by the client as needed. It also allows the client to implement changes to the PowerShell scripted functionality without requiring code review by SailPoint because the code runs outside of the IdentityNow platform.
## Rule Template
-This example triggers on the BeforeCreate operation. If you want
-to use another operation, replace `BeforeCreate` in the name and
-`ConnectorBeforeCreate` in the type with one of the other operations described
-earlier in the [Overview](#overview) section.
+This example triggers on the BeforeCreate operation. If you want to use another operation, replace `BeforeCreate` in the name and `ConnectorBeforeCreate` in the type with one of the other operations described earlier in the [Overview](#overview) section.
```xml
@@ -135,10 +122,7 @@ if($enableDebug) {
## Powershell Script Template
-You can also use the following Powershell script template for each operation in
-the [Overview](#overview) section. Be sure to update the `$logFile` variable
-with the operation you use to ensure you are logging to a file with the correct
-operation name.
+You can also use the following Powershell script template for each operation in the [Overview](#overview) section. Be sure to update the `$logFile` variable with the operation you use to ensure you are logging to a file with the correct operation name.
```powershell
###############################################################################################################################
diff --git a/products/idn/docs/identity-now/rules/connector-rules/build_map_rule.md b/products/idn/docs/identity-now/rules/connector-rules/build_map_rule.md
index b2bf03b6b..3683dd295 100644
--- a/products/idn/docs/identity-now/rules/connector-rules/build_map_rule.md
+++ b/products/idn/docs/identity-now/rules/connector-rules/build_map_rule.md
@@ -4,11 +4,10 @@ title: BuildMap Rule
pagination_label: BuildMap Rule
sidebar_label: BuildMap Rule
sidebar_class_name: buildMapRule
-keywords: ["cloud", "rules"]
-description: This rule manipulates raw input data provided by the
- rows and columns in a file and builds a map from the incoming data.
+keywords: ['cloud', 'rules']
+description: This rule manipulates raw input data provided by the rows and columns in a file and builds a map from the incoming data.
slug: /docs/rules/connector-rules/buildmap-rule
-tags: ["Rules"]
+tags: ['Rules']
---
# BuildMap Rule
@@ -19,22 +18,19 @@ This rule manipulates raw input data provided by the rows and columns in a file
## Execution
-- **Connector Execution** - This rule executes within the virtual appliance. It
- may offer special abilities to perform connector-related functions, and it may
- offer managed connections to sources.
-- **Logging** - Logging statements are viewable within the ccg.log on the
- virtual appliance, and they are viewable by SailPoint personnel.
+- **Connector Execution** - This rule executes within the virtual appliance. It may offer special abilities to perform connector-related functions, and it may offer managed connections to sources.
+- **Logging** - Logging statements are viewable within the ccg.log on the virtual appliance, and they are viewable by SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------- | ---------------------------- | ------------------------------------------------------------------------------------------- |
-| col | java.util.List | Ordered list of the column names from the file’s header records or specified columns list. |
-| record | java.util.List | Ordered list of the values for the current record, parsed based on the specified delimiter. |
-| application | System.Collections.Hashtable | Map of the application configuration. |
-| schema | sailpoint.object.Schema | Reference to the schema object for the delimited file source being read. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| col | java.util.List | Ordered list of the column names from the file’s header records or specified columns list. |
+| record | java.util.List | Ordered list of the values for the current record, parsed based on the specified delimiter. |
+| application | System.Collections.Hashtable | Map of the application configuration. |
+| schema | sailpoint.object.Schema | Reference to the schema object for the delimited file source being read. |
## Template
diff --git a/products/idn/docs/identity-now/rules/connector-rules/index.md b/products/idn/docs/identity-now/rules/connector-rules/index.md
index fc7fe46df..706b19e54 100644
--- a/products/idn/docs/identity-now/rules/connector-rules/index.md
+++ b/products/idn/docs/identity-now/rules/connector-rules/index.md
@@ -5,65 +5,48 @@ pagination_label: Connector Executed Rules
sidebar_label: Connector Executed Rules
sidebar_position: 1
sidebar_class_name: cloudExecutedRules
-keywords: ["connector", "rules"]
+keywords: ['connector', 'rules']
description: Overview of connector-executed rules.
slug: /docs/rules/connector-rules
-tags: ["Rules"]
+tags: ['Rules']
---
-**Connector-Executed Rules** or **Connector Rules** are rules that are executed
-in the IdentityNow virtual appliance, and they are usually extensions of the
-connector itself. The rules are commonly used to perform complex
-connector-related functions, so they are specific to only certain connectors.
-Because these rules execute in the virtual appliance, they do not have access to
-query the IdentityNow data model or fetch information from IdentityNow. They
-rely instead on contextual information sent from IdentityNow. Connector-executed
-rules may also have managed connections provided in their contexts to support
-querying end systems or sources. Though these managed connections may be used,
-making additional connections or call-outs is not allowed.
+**Connector-Executed Rules** or **Connector Rules** are rules that are executed in the IdentityNow virtual appliance, and they are usually extensions of the connector itself. The rules are commonly used to perform complex connector-related functions, so they are specific to only certain connectors. Because these rules execute in the virtual appliance, they do not have access to query the IdentityNow data model or fetch information from IdentityNow. They rely instead on contextual information sent from IdentityNow. Connector-executed rules may also have managed connections provided in their contexts to support querying end systems or sources. Though these managed connections may be used, making additional connections or call-outs is not allowed.
-Unlike cloud rules, connector rules do not have a rule review process and are
-directly editable with the
-[Connector Rule REST APIs](https://developer.sailpoint.com/idn/api/beta/connector-rule-management).
-For more details, see [Configuration Process](#configuration-process).
+Unlike cloud rules, connector rules do not have a rule review process and are directly editable with the [Connector Rule REST APIs](https://developer.sailpoint.com/idn/api/beta/connector-rule-management). For more details, see [Configuration Process](#configuration-process).
## Supported Connector Rules
-| Rule Name | Rule Type | Source Type(s) | Purpose |
-| -------------------------------------------------------- | --------------------------------------------------------- | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Before Creation Rule](./before_after_operation_rule.md) | [ConnectorBeforeCreate](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is created. |
-| [Before Modify Rule](./before_after_operation_rule.md) | [ConnectorBeforeModify](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is modified. |
-| [Before Delete Rule](./before_after_operation_rule.md) | [ConnectorBeforeDelete](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is deleted. |
-| [After Creation Rule](./before_after_operation_rule.md) | [ConnectorAfterCreate](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is created. |
-| [After Modify Rule](./before_after_operation_rule.md) | [ConnectorAfterModify](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is modified. |
-| [After Delete Rule](./before_after_operation_rule.md) | [ConnectorAfterDelete](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is deleted. |
-| Build Map Rule | BuildMap | Delimited File | Calculates and transforms data from a parsed file during the aggregation process. _Note: This is only available for the Delimited File source type, not Generic source types._ |
-| JDBC Build Map Rule | JDBCBuildMap | JDBC | Calculates and transforms data from a database query result during the aggregation process. It can also perform additional calls back to the database. _Note: This rule is available for the JDBC Generic source, as well as other sources that derive from the JDBC connector (e.g., Oracle EBS, PeopleSoft, etc.)_ |
-| JDBC Provision Rule | JDBCProvision | JDBC | Executes database queries to perform provisioning of account and access for all account operations. |
-| SAP Build Map Rule | SAPBuildMap | SAP HR, SAP | Calculates and transforms data from SAP during the aggregation process. It can also perform additional calls back to the SAP system using SAP BAPI calls. |
-| SAP HR Provisioning Modify Rule | SapHrOperationProvisioning | SAP HR | Performs SAP HR modification operations during provisioning. Often used for attribute sync to custom SAP HR attributes. |
-| Web Services Before Operation Rule | WebServiceBeforeOperationRule | Web Services | Executes before the next web-services HTTP(S) operation. Often used to calculate values. |
-| Web Services After Operation Rule | WebServiceAfterOperationRule | Web Services | Executes after a web-services HTTP(S) operation. Often used to parse complex data. |
+| Rule Name | Rule Type | Source Type(s) | Purpose |
+| --- | --- | --- | --- |
+| [Before Creation Rule](./before_after_operation_rule.md) | [ConnectorBeforeCreate](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is created. |
+| [Before Modify Rule](./before_after_operation_rule.md) | [ConnectorBeforeModify](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is modified. |
+| [Before Delete Rule](./before_after_operation_rule.md) | [ConnectorBeforeDelete](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component before a source account is deleted. |
+| [After Creation Rule](./before_after_operation_rule.md) | [ConnectorAfterCreate](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is created. |
+| [After Modify Rule](./before_after_operation_rule.md) | [ConnectorAfterModify](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is modified. |
+| [After Delete Rule](./before_after_operation_rule.md) | [ConnectorAfterDelete](./before_after_operation_rule.md) | Active Directory, Azure Active Directory | Executes PowerShell commands on the IQService component after a source account is deleted. |
+| Build Map Rule | BuildMap | Delimited File | Calculates and transforms data from a parsed file during the aggregation process. _Note: This is only available for the Delimited File source type, not Generic source types._ |
+| JDBC Build Map Rule | JDBCBuildMap | JDBC | Calculates and transforms data from a database query result during the aggregation process. It can also perform additional calls back to the database. _Note: This rule is available for the JDBC Generic source, as well as other sources that derive from the JDBC connector (e.g., Oracle EBS, PeopleSoft, etc.)_ |
+| JDBC Provision Rule | JDBCProvision | JDBC | Executes database queries to perform provisioning of account and access for all account operations. |
+| SAP Build Map Rule | SAPBuildMap | SAP HR, SAP | Calculates and transforms data from SAP during the aggregation process. It can also perform additional calls back to the SAP system using SAP BAPI calls. |
+| SAP HR Provisioning Modify Rule | SapHrOperationProvisioning | SAP HR | Performs SAP HR modification operations during provisioning. Often used for attribute sync to custom SAP HR attributes. |
+| Web Services Before Operation Rule | WebServiceBeforeOperationRule | Web Services | Executes before the next web-services HTTP(S) operation. Often used to calculate values. |
+| Web Services After Operation Rule | WebServiceAfterOperationRule | Web Services | Executes after a web-services HTTP(S) operation. Often used to parse complex data. |
## Configuration Process
-Connector Rules are directly editable with the
-[Connector Rule REST APIs](https://developer.sailpoint.com/idn/api/beta/connector-rule-management),
-which provide ability to interact with rules directly.
+Connector Rules are directly editable with the [Connector Rule REST APIs](https://developer.sailpoint.com/idn/api/beta/connector-rule-management), which provide ability to interact with rules directly.
-| Name | Path |
-| ----------------------------------------------------------------------------------------------------- | ------------------------------------- |
-| [List Connector Rules](https://developer.sailpoint.com/apis/beta/#operation/getConnectorRuleList) | `GET /beta/connector-rules/` |
-| [Get Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/getConnectorRule) | `GET /beta/connector-rules/{id}` |
-| [Create Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/createConnectorRule) | `POST /beta/connector-rules/` |
-| [Update Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/updateConnectorRule) | `PUT /beta/connector-rules/{id}` |
-| [Delete Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/deleteConnectorRule) | `DELETE /beta/connector-rules/{id}` |
+| Name | Path |
+| --- | --- |
+| [List Connector Rules](https://developer.sailpoint.com/apis/beta/#operation/getConnectorRuleList) | `GET /beta/connector-rules/` |
+| [Get Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/getConnectorRule) | `GET /beta/connector-rules/{id}` |
+| [Create Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/createConnectorRule) | `POST /beta/connector-rules/` |
+| [Update Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/updateConnectorRule) | `PUT /beta/connector-rules/{id}` |
+| [Delete Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/deleteConnectorRule) | `DELETE /beta/connector-rules/{id}` |
| [Validate Connector Rule](https://developer.sailpoint.com/apis/beta/#operation/validateConnectorRule) | `POST /beta/connector-rules/validate` |
-SailPoint architectural optimizations have added resiliency and protections
-against malformed or long-running rules. These APIs also offer built-in
-protection and checking against potentially harmful code. For more information,
-see [Rule Code Restrictions](../../rules/index.md#rule-code-restrictions).
+SailPoint architectural optimizations have added resiliency and protections against malformed or long-running rules. These APIs also offer built-in protection and checking against potentially harmful code. For more information, see [Rule Code Restrictions](../../rules/index.md#rule-code-restrictions).
## Connector Rule Object Model
@@ -90,46 +73,27 @@ requestEndPoint.getBody().put(\"jsonBody\",requestXML); \n }\n
}
```
-- `id` - Unique UUID that the REST APIs refers to this rule by. This is
- generated on creation.
+- `id` - Unique UUID that the REST APIs refers to this rule by. This is generated on creation.
- `name` - Name the user interface and references may use to refer to this rule.
- `description` - Description of the rule’s purpose or usage.
- `created` - Timestamp when the rule was created.
- `modified` - Timestamp when the rule was last modified. The default is `null`.
-- `type` - Type of connector rule. For a list of supported rule types, see
- [Supported Connector Rules](#supported-connector-rules).
+- `type` - Type of connector rule. For a list of supported rule types, see [Supported Connector Rules](#supported-connector-rules).
- `attributes` - List of attributes.
- - `sourceVersion` - String indicating the rule's version. Typically, this is
- the same as `version`.
+ - `sourceVersion` - String indicating the rule's version. Typically, this is the same as `version`.
- `sourceCode` - Object housing the actual source code that makes the rule work.
- - `version` - String indicating the rule's version. Typically, this is the
- same as `sourceVersion`.
- - `script` - Rule’s code the connector runs. This must be an escaped string.
- For help with formatting, use an escaping tool like
- [Free Formatter.](https://www.freeformatter.com/java-dotnet-escape.html#before-output)
+ - `version` - String indicating the rule's version. Typically, this is the same as `sourceVersion`.
+ - `script` - Rule’s code the connector runs. This must be an escaped string. For help with formatting, use an escaping tool like [Free Formatter.](https://www.freeformatter.com/java-dotnet-escape.html#before-output)
## Attaching Connector-Related Rules to Sources
-Once a connector-related rule has been imported to your tenant, you must
-configure any sources that need to reference that rule during the desired
-operation. You can accomplish this configuration through the execution of an API
-call on the source. The following examples all use a `PATCH` operation for a
-partial source update, but `PUT` operations work too, as long as the entire
-source object model is provided.
+Once a connector-related rule has been imported to your tenant, you must configure any sources that need to reference that rule during the desired operation. You can accomplish this configuration through the execution of an API call on the source. The following examples all use a `PATCH` operation for a partial source update, but `PUT` operations work too, as long as the entire source object model is provided.
-For the `PATCH` operations, you must provide an `op` key. For new
-configurations, this key is typically set to `add` as the example shows, but
-they can be any of the following:
+For the `PATCH` operations, you must provide an `op` key. For new configurations, this key is typically set to `add` as the example shows, but they can be any of the following:
-- `add` - Add a new value to the configuration. Use this operation if this is
- the first time you are setting the value, i.e. it has never been configured
- before.
-- `replace` - Use this operation to change the existing value. Use this
- operation if you are updating the value, i.e. you want to change the
- configuration.
-- `remove` - Removes a value from the configuration. Use this operation if you
- want to unset a value. **Caution: Removals can be destructive if the path is
- improperly configured. This can negatively alter your source config.**
+- `add` - Add a new value to the configuration. Use this operation if this is the first time you are setting the value, i.e. it has never been configured before.
+- `replace` - Use this operation to change the existing value. Use this operation if you are updating the value, i.e. you want to change the configuration.
+- `remove` - Removes a value from the configuration. Use this operation if you want to unset a value. **Caution: Removals can be destructive if the path is improperly configured. This can negatively alter your source config.**
## Example API calls by Rule Type
@@ -247,9 +211,7 @@ Content-Type: `application/json-patch+json`
Content-Type: `application/json-patch+json`
-_Note: Replace
-`_`with the index location of operation the way it is configured on the source. For example, 0, 1, 2, etc. You can use a`GET`call on the source first to verify the index location prior to executing the`PATCH`
-call to attach the rule.\*
+_Note: Replace `_`with the index location of operation the way it is configured on the source. For example, 0, 1, 2, etc. You can use a`GET`call on the source first to verify the index location prior to executing the`PATCH` call to attach the rule.\*
```json
[
@@ -265,10 +227,7 @@ call to attach the rule.\*
`PATCH` /v3/sources/{id} Content-Type: `application/json-patch+json`
-_Note: Replace \[\*\] with the index location of the operation the way it is
-configured on the source. For example, 0, 1, 2, etc. You can use a `GET` call on
-the source first to verify the index location prior to executing the `PATCH`
-call to attach the rule._
+_Note: Replace \[\*\] with the index location of the operation the way it is configured on the source. For example, 0, 1, 2, etc. You can use a `GET` call on the source first to verify the index location prior to executing the `PATCH` call to attach the rule._
```json
[
diff --git a/products/idn/docs/identity-now/rules/connector-rules/jdbc_build_map_rule.md b/products/idn/docs/identity-now/rules/connector-rules/jdbc_build_map_rule.md
index bc739ceba..6939bdc23 100644
--- a/products/idn/docs/identity-now/rules/connector-rules/jdbc_build_map_rule.md
+++ b/products/idn/docs/identity-now/rules/connector-rules/jdbc_build_map_rule.md
@@ -4,11 +4,10 @@ title: JDBC BuildMap Rule
pagination_label: JDBC BuildMap Rule
sidebar_label: JDBC BuildMap Rule
sidebar_class_name: jdbcBuildMapRule
-keywords: ["cloud", "rules"]
-description: This rule manipulates raw input data provided by the
- rows and columns in a file and builds a map from the incoming data.
+keywords: ['cloud', 'rules']
+description: This rule manipulates raw input data provided by the rows and columns in a file and builds a map from the incoming data.
slug: /docs/rules/connector-rules/jdbc-buildmap-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
@@ -17,29 +16,26 @@ This rule manipulates raw input data provided by the rows and columns in a file
## Execution
-- **Connector Execution** - This rule executes within the virtual appliance. It
- may offer special abilities to perform connector-related functions, and it may
- offer managed connections to sources.
-- **Logging** - Logging statements are viewable within the ccg.log on the
- virtual appliance, and they are viewable by SailPoint personnel.
+- **Connector Execution** - This rule executes within the virtual appliance. It may offer special abilities to perform connector-related functions, and it may offer managed connections to sources.
+- **Logging** - Logging statements are viewable within the ccg.log on the virtual appliance, and they are viewable by SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------- |
-| result | java.sql.ResultSet | Current ResultSet from the JDBC Connector. |
-| connection | java.sql.Connection | Reference to the current SQL connection. |
-| state | java.util.Map | Map that can be used to store and share data between executions of this rule during a single aggregation run. |
-| application | sailpoint.object.Application | Attribute value of the identity attribute before the rule runs. |
-| schema | sailpoint.object.Schema | Reference to the schema object for the delimited file source being read. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| result | java.sql.ResultSet | Current ResultSet from the JDBC Connector. |
+| connection | java.sql.Connection | Reference to the current SQL connection. |
+| state | java.util.Map | Map that can be used to store and share data between executions of this rule during a single aggregation run. |
+| application | sailpoint.object.Application | Attribute value of the identity attribute before the rule runs. |
+| schema | sailpoint.object.Schema | Reference to the schema object for the delimited file source being read. |
## Output
-| Argument | Type | Purpose |
-| -------- | ------------ | ---------------------------------------------------------------------- |
-| map | java.utl.Map | Map of names/values representing a row of data from the JDBC resource. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| map | java.utl.Map | Map of names/values representing a row of data from the JDBC resource. |
## Template
diff --git a/products/idn/docs/identity-now/rules/connector-rules/jdbc_provision_rule.md b/products/idn/docs/identity-now/rules/connector-rules/jdbc_provision_rule.md
index 4fe9088c3..28c2f2574 100644
--- a/products/idn/docs/identity-now/rules/connector-rules/jdbc_provision_rule.md
+++ b/products/idn/docs/identity-now/rules/connector-rules/jdbc_provision_rule.md
@@ -4,43 +4,37 @@ title: JDBC Provision Rule
pagination_label: JDBC Provision Rule
sidebar_label: JDBC Provision Rule
sidebar_class_name: jdbcProvisionRule
-keywords: ["cloud", "rules", "jdbc"]
-description: This rule performs provisioning actions from a provisioning
- plan provided by a supplied JDBC connection. These actions typically issue SQL commands, such
- as insert, update, select, and delete.
+keywords: ['cloud', 'rules', 'jdbc']
+description: This rule performs provisioning actions from a provisioning plan provided by a supplied JDBC connection. These actions typically issue SQL commands, such as insert, update, select, and delete.
slug: /docs/rules/connector-rules/jdbc-provisioning-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
-This rule performs provisioning actions from a provisioning plan provided by a supplied JDBC connection.
-These actions typically issue SQL commands, such as insert, update, select, and delete.
+This rule performs provisioning actions from a provisioning plan provided by a supplied JDBC connection. These actions typically issue SQL commands, such as insert, update, select, and delete.
## Execution
-- **Connector Execution** - This rule executes within the virtual appliance. It
- may offer special abilities to perform connector-related functions, and it may
- offer managed connections to sources.
-- **Logging** - Logging statements are viewable within the ccg.log on the
- virtual appliance, and they are viewable by SailPoint personnel.
+- **Connector Execution** - This rule executes within the virtual appliance. It may offer special abilities to perform connector-related functions, and it may offer managed connections to sources.
+- **Logging** - Logging statements are viewable within the ccg.log on the virtual appliance, and they are viewable by SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------- | --------------------------------- | ------------------------------------------------------------------------ |
-| connection | java.sql.Connection | Reference to the current SQL connection. |
-| plan | sailpoint.object.ProvisioningPlan | Provisioning plan containing the provisioning request(s). |
-| application | sailpoint.object.Application | Attribute value for the identity attribute before the rule runs. |
-| schema | sailpoint.object.Schema | Reference to the schema object for the delimited file source being read. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| connection | java.sql.Connection | Reference to the current SQL connection. |
+| plan | sailpoint.object.ProvisioningPlan | Provisioning plan containing the provisioning request(s). |
+| application | sailpoint.object.Application | Attribute value for the identity attribute before the rule runs. |
+| schema | sailpoint.object.Schema | Reference to the schema object for the delimited file source being read. |
## Output
-| Argument | Type | Purpose |
-| -------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------- |
-| result | sailpoint.object.ProvisioningResult | ProvisioningResult object containing the provisioning request's status (success, failure, retry, etc.). |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| result | sailpoint.object.ProvisioningResult | ProvisioningResult object containing the provisioning request's status (success, failure, retry, etc.). |
## Template
diff --git a/products/idn/docs/identity-now/rules/connector-rules/sap_buildmap_rule.md b/products/idn/docs/identity-now/rules/connector-rules/sap_buildmap_rule.md
index 4467fb9ce..0c5faeaff 100644
--- a/products/idn/docs/identity-now/rules/connector-rules/sap_buildmap_rule.md
+++ b/products/idn/docs/identity-now/rules/connector-rules/sap_buildmap_rule.md
@@ -4,39 +4,33 @@ title: SAP BuildMap Rule
pagination_label: SAP BuildMap Rule
sidebar_label: SAP BuildMap Rule
sidebar_class_name: sapBuildMapRule
-keywords: ["cloud", "rules", "sap"]
-description: This rule gathers additional attributes from SAP systems to
- build accounts. This rule is implemented using SAP's Java Connector (JCo)
- framework provided by a supplied SAP connection.
+keywords: ['cloud', 'rules', 'sap']
+description: This rule gathers additional attributes from SAP systems to build accounts. This rule is implemented using SAP's Java Connector (JCo) framework provided by a supplied SAP connection.
slug: /docs/rules/connector-rules/sap-buildmap-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
-This rule gathers additional attributes from SAP systems to build accounts.
-This rule is implemented using SAP's Java Connector (JCo) framework provided by a supplied SAP connection.
+This rule gathers additional attributes from SAP systems to build accounts. This rule is implemented using SAP's Java Connector (JCo) framework provided by a supplied SAP connection.
## Execution
-- **Connector Execution** - This rule executes within the virtual appliance. It
- may offer special abilities to perform connector-related functions, and it may
- offer managed connections to sources.
-- **Logging** - Logging statements are viewable within the ccg.log on the
- virtual appliance, and they are viewable by SailPoint personnel.
+- **Connector Execution** - This rule executes within the virtual appliance. It may offer special abilities to perform connector-related functions, and it may offer managed connections to sources.
+- **Logging** - Logging statements are viewable within the ccg.log on the virtual appliance, and they are viewable by SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------- | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| object | sailpoint.object.Attributes | Reference to a SailPoint attributes object (basically a map object with some added convenience methods) that holds the attributes that have been built up by the default connector implementation. The rule should modify this object to change, add, or remove attributes from the map. |
-| connector | sailpoint.connector.SAPInternalConnector | Reference to the current SAP connector. |
-| state | java.util.Map | Map that can be used to store and share data between executions of this rule during a single aggregation run. |
-| application | sailpoint.object.Application | Attribute value for the identity attribute before the rule runs. |
-| schema | sailpoint.object.Schema | Reference to the schema object for the delimited file source being read. |
-| destination | com.sap.conn.jco.JCoDestination | Connected and ready-to-use SAP destination object that can be used to call BAPI function modules and call to SAP tables. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| object | sailpoint.object.Attributes | Reference to a SailPoint attributes object (basically a map object with some added convenience methods) that holds the attributes that have been built up by the default connector implementation. The rule should modify this object to change, add, or remove attributes from the map. |
+| connector | sailpoint.connector.SAPInternalConnector | Reference to the current SAP connector. |
+| state | java.util.Map | Map that can be used to store and share data between executions of this rule during a single aggregation run. |
+| application | sailpoint.object.Application | Attribute value for the identity attribute before the rule runs. |
+| schema | sailpoint.object.Schema | Reference to the schema object for the delimited file source being read. |
+| destination | com.sap.conn.jco.JCoDestination | Connected and ready-to-use SAP destination object that can be used to call BAPI function modules and call to SAP tables. |
## Template
diff --git a/products/idn/docs/identity-now/rules/connector-rules/sap_hr_provisioning_modify_rule.md b/products/idn/docs/identity-now/rules/connector-rules/sap_hr_provisioning_modify_rule.md
index 6ffd3b954..4db238bb1 100644
--- a/products/idn/docs/identity-now/rules/connector-rules/sap_hr_provisioning_modify_rule.md
+++ b/products/idn/docs/identity-now/rules/connector-rules/sap_hr_provisioning_modify_rule.md
@@ -4,45 +4,39 @@ title: SAP HR Provisioning Modify Rule
pagination_label: SAP HR Provisioning Modify Rule
sidebar_label: SAP HR Provisioning Modify Rule
sidebar_class_name: sapHRProvisioningModifyRule
-keywords: ["cloud", "rules", "sap"]
-description: This rule performs SAP HR modification operations during
- provisioning. This rule is typically used for attribute sync to custom SAP HR
- attributes.
+keywords: ['cloud', 'rules', 'sap']
+description: This rule performs SAP HR modification operations during provisioning. This rule is typically used for attribute sync to custom SAP HR attributes.
slug: /docs/rules/connector-rules/sap-provisioning-modify-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
-This rule performs SAP HR modification operations during provisioning.
-This rule is typically used for attribute sync to custom SAP HR attributes.
+This rule performs SAP HR modification operations during provisioning. This rule is typically used for attribute sync to custom SAP HR attributes.
## Execution
-- **Connector Execution** - This rule executes within the virtual appliance. It
- may offer special abilities to perform connector-related functions, and it may
- offer managed connections to sources.
-- **Logging** - Logging statements are viewable within the ccg.log on the
- virtual appliance, and they are viewable by SailPoint personnel.
+- **Connector Execution** - This rule executes within the virtual appliance. It may offer special abilities to perform connector-related functions, and it may offer managed connections to sources.
+- **Logging** - Logging statements are viewable within the ccg.log on the virtual appliance, and they are viewable by SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| application | sailpoint.object.Application | Reference to the application object. |
-| schema | sailpoint.object.Schema | Reference to the application schema. |
-| destination | com.sap.conn.jco.JCoDestination | Connected and ready-to-use SAP destination object that can be used to call BAPI function modules and call to SAP tables. |
-| plan | sailpoint.object.ProvisioningPlan | Provisioning plan containing the provisioning request(s). |
-| request | sailpoint.object.ProvisioningPlan.AbstractRequest | AccountRequest being processed. It is always null for this global rule. It is only set for SapHrOperationProvisioning. |
-| connector | sailpoint.connector.SAPHRConnector | Application connector being used for the operation. |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| application | sailpoint.object.Application | Reference to the application object. |
+| schema | sailpoint.object.Schema | Reference to the application schema. |
+| destination | com.sap.conn.jco.JCoDestination | Connected and ready-to-use SAP destination object that can be used to call BAPI function modules and call to SAP tables. |
+| plan | sailpoint.object.ProvisioningPlan | Provisioning plan containing the provisioning request(s). |
+| request | sailpoint.object.ProvisioningPlan.AbstractRequest | AccountRequest being processed. It is always null for this global rule. It is only set for SapHrOperationProvisioning. |
+| connector | sailpoint.connector.SAPHRConnector | Application connector being used for the operation. |
## Output
-| Argument | Type | Purpose |
-| -------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------- |
-| result | sailpoint.object.ProvisioningResult | ProvisioningResult object containing the provisioning request's status (success, failure, retry, etc.). |
+| Argument | Type | Purpose |
+| --- | --- | --- |
+| result | sailpoint.object.ProvisioningResult | ProvisioningResult object containing the provisioning request's status (success, failure, retry, etc.). |
## Template
diff --git a/products/idn/docs/identity-now/rules/connector-rules/web_services_after_operation_rule.md b/products/idn/docs/identity-now/rules/connector-rules/web_services_after_operation_rule.md
index 0e15b2f64..8c0335987 100644
--- a/products/idn/docs/identity-now/rules/connector-rules/web_services_after_operation_rule.md
+++ b/products/idn/docs/identity-now/rules/connector-rules/web_services_after_operation_rule.md
@@ -4,10 +4,10 @@ title: Web Services After Operation Rule
pagination_label: Web Services After Operation Rule
sidebar_label: Web Services After Operation Rule
sidebar_class_name: webServicesAfterOperationRule
-keywords: ["cloud", "rules", "webservices"]
+keywords: ['cloud', 'rules', 'webservices']
description: This rule calculates attributes after a web-service operation call.
slug: /docs/rules/connector-rules/webservices-after-provisioning-rule
-tags: ["Rules"]
+tags: ['Rules']
---
## Overview
@@ -16,28 +16,25 @@ This rule calculates attributes after a web-service operation call.
## Execution
-- **Connector Execution** - This rule executes within the virtual appliance. It
- may offer special abilities to perform connector-related functions, and it may
- offer managed connections to sources.
-- **Logging** - Logging statements are viewable within the ccg.log on the
- virtual appliance, and they are viewable by SailPoint personnel.
+- **Connector Execution** - This rule executes within the virtual appliance. It may offer special abilities to perform connector-related functions, and it may offer managed connections to sources.
+- **Logging** - Logging statements are viewable within the ccg.log on the virtual appliance, and they are viewable by SailPoint personnel.

## Input
-| Argument | Type | Purpose |
-| ----------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| application | sailpoint.object.Application | Application whose data file is being processed. |
-| processedResponseObject | List