Integration

SailPoint Identity Security Cloud integration

SailPoint Identity Security Cloud (formerly IdentityNow) governs who has access to what. Look up identities, accounts, entitlements, access profiles, roles and sources; submit, approve, reject or cancel access requests; work through approvals, work items and certification campaigns; manage governance groups, tags, saved searches, non-employee records and SOD violations; run Elasticsearch-style searches, aggregations, account aggregations and reports. Left out: tenant security and password settings, OAuth clients, personal access tokens and credential or parameter storage (they return or change secrets), connector and cluster administration, source, transform and workflow creation, and every experimental route (it needs the X-SailPoint-Experimental header). Free-form identity and account attribute maps, connector configuration, entitlement source attributes, phone numbers, form answers and fields and workflow step definitions are not returned. Authentication: OAuth2 client credentials on https://<tenant>.api.identitynow.com/oauth/token, with the client ID and secret of a personal access token (Preferences > Personal Access Tokens; calls act with that user's rights) or of an API client (some user-context routes then refuse). Rate limit: 100 requests per access token per 10 seconds.

Connect SailPoint Identity Security Cloud How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in SailPoint Identity Security Cloud.Built from the 153 SailPoint Identity Security Cloud tools below, on the connection you add once.

What you can do with SailPoint Identity Security Cloud

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Account, 6 operations

create_accountCreate accountPOSTSubmits an account creation task on the live tenant and returns its task id. Put sourceId inside attributes. Meant for flat file sources: it records the account in SailPoint, it does not provision it on the target system.
delete_accountDelete accountDELETESubmits a task deleting an account from the live tenant ("DelimitedFile" sources only) and returns the task id. SailPoint only, so the next aggregation can bring it back; prefer disable_account for connected sources.
disable_accountDisable accountPOSTDisables an account on its source system through the live tenant, cutting that account's access on the target system: submits a provisioning task and returns the task id. Reverse it with enable_account.
enable_accountEnable accountPOSTEnables an account on its source system through the live tenant, restoring that account's access on the target system: submits a provisioning task and returns the task id.
get_accountGet accountGETReturns one account by id: source, identity, native identity, status flags (disabled, locked, uncorrelated) and timestamps. Account attribute maps are not returned.
list_accountsList accountsGETLists accounts across sources (paged). Filter with filters, e.g. sourceId eq "<id>" or identityId eq "<id>". Account attribute maps are not returned. Needs idn:accounts:read.

Campaign, 6 operations

activate_campaignActivate campaignPOSTActivates (launches) a STAGED certification campaign on the live tenant, which sends its certifications to reviewers. Optional timeZone for the deadline.
complete_campaignComplete campaignPOSTCompletes a past-due certification campaign on the live tenant (error otherwise). Undecided items follow autoCompleteAction: APPROVE keeps the access, REVOKE removes it; APPROVE when left out. ORG_ADMIN or CERT_ADMIN.
create_campaignCreate campaignPOSTCreates a certification campaign (name, description and type required). It starts STAGED: call activate_campaign to launch it. A campaign filter also needs idn:campaign-filter:read.
generate_campaign_from_templateGenerate campaign from templatePOSTGenerates a new certification campaign from a template; date placeholders such as %Y in the template name are filled with the current date. Returns the campaign reference.
get_campaignGet campaignGETReturns one certification campaign: type, status, deadline, filter, sources, counts of certifications and decisions.
list_campaignsList campaignsGETLists certification campaigns (name, type, status, deadline); detail=FULL adds counts and filters. Filter by id, name, status.

Access profile, 4 operations

create_access_profileCreate access profilePOSTCreates an access profile from entitlements of one source; name, owner and source are required. Description is limited to 2000 characters. ROLE_SUBADMIN/SOURCE_SUBADMIN need the source.
delete_access_profileDelete access profileDELETEPermanently deletes an access profile from the live tenant. Fails with 400 when it is still used by an application, a lifecycle state or a role. A SOURCE_SUBADMIN must administer its source.
get_access_profileGet access profileGETReturns one access profile by id: source, entitlements, owner, requestable, request and revocation approval settings and segments.
list_access_profilesList access profilesGETLists access profiles (bundles of entitlements from one source): name, source, owner, enabled, requestable and entitlements. A filter on a name with "+" returns an empty list.

Access request approval, 4 operations

approve_access_request_approvalApprove access request approvalPOSTApproves an access request approval on the live tenant (approvalId from list_pending_access_request_approvals). When the last approval passes, the requested access is granted (or removed, for a revoke request). Only the approval owner or ORG_ADMIN.
forward_access_request_approvalForward access request approvalPOSTForwards an access request approval on the live tenant to another identity (newOwnerId), who can then approve or reject it, with a comment. Only the approval owner or ORG_ADMIN.
list_completed_access_request_approvalsList completed access request approvalsGETLists completed access request approvals; owner-id selects whose (default: the caller, other owners need ORG_ADMIN).
list_pending_access_request_approvalsList pending access request approvalsGETLists pending access request approvals; owner-id selects whose (default: the caller, other owners need ORG_ADMIN). The id feeds approve_access_request_approval.

Governance group, 4 operations

create_governance_groupCreate governance groupPOSTCreates a governance group with a name, description and owner (identity reference). ORG_ADMIN only; add members with add_governance_group_members.
delete_governance_groupDelete governance groupDELETEPermanently deletes a governance group from the live tenant. ORG_ADMIN only.
get_governance_groupGet governance groupGETReturns one governance group: name, description, owner, member count and connection count.
list_governance_groupsList governance groupsGETLists governance groups (workgroups): name, description, owner, member and connection counts. ORG_ADMIN only.

Non employee record, 4 operations

create_non_employee_recordCreate non employee recordPOSTCreates a non-employee record directly (accountName, firstName, lastName, email, phone, manager, sourceId, startDate, endDate required). Needs role context idn:nesr:create.
delete_non_employee_recordDelete non employee recordDELETEPermanently deletes a non-employee record from the live tenant. Needs role context idn:nesr:delete.
get_non_employee_recordGet non employee recordGETReturns one non-employee record: account name, names, email, manager, source and start/end dates. Phone and custom attributes are not returned.
list_non_employee_recordsList non employee recordsGETLists non-employee records (contractors and other non-employees): name, account name, email, manager, source and dates. Phone numbers and custom attributes are not returned.

Role, 4 operations

create_roleCreate rolePOSTCreates a role on the live tenant grouping access profiles and entitlements; name and owner required. An enabled role with membership criteria or identities is assigned to them, granting its access. Description max 2000 characters.
delete_roleDelete roleDELETEPermanently deletes a role from the live tenant. Needs API, ORG_ADMIN, ROLE_ADMIN or ROLE_SUBADMIN (a ROLE_SUBADMIN only when the role's access profiles are on sources it manages).
get_roleGet roleGETReturns one role by id: owner, access profiles, entitlements, membership criteria, request settings and segments.
list_rolesList rolesGETLists roles: name, owner, access profiles, entitlements, membership criteria, enabled, requestable. Needs API, ORG_ADMIN, ROLE_ADMIN or ROLE_SUBADMIN.

Saved search, 4 operations

create_saved_searchCreate saved searchPOSTCreates a saved search (name, indices and query required) that can later be scheduled.
delete_saved_searchDelete saved searchDELETEPermanently deletes a saved search from the live tenant.
get_saved_searchGet saved searchGETReturns one saved search by id: indices, query, columns, fields, sort and filters.
list_saved_searchesList saved searchesGETLists the saved searches of the caller: name, indices, query, columns, sort.

Work item, 4 operations

complete_work_itemComplete work itemPOSTCompletes a work item on the live tenant. Only an admin or the work item owner.
forward_work_itemForward work itemPOSTForwards a work item to another identity (targetOwnerId) with a comment. Only an admin or the work item owner.
get_work_itemGet work itemGETReturns one work item: type, state, description, owner, approval items and form.
list_completed_work_itemsList completed work itemsGETLists the completed work items of the caller, or of ownerId (admin required).

Access request, 3 operations

cancel_access_requestCancel access requestPOSTCancels, on the live tenant, a pending access request that has not passed its approval step (accountActivityId = the request id). ORG_ADMIN or the original requester.
close_access_requestClose access requestPOSTCloses, on the live tenant, access requests stuck in a pending state, at any stage (unlike cancel). Pass their tracking numbers (account activity ids). ORG_ADMIN only.
create_access_requestCreate access requestPOSTSubmits an access request on the live tenant: GRANT_ACCESS gives identities roles, access profiles or entitlements, REVOKE_ACCESS removes them, MODIFY_ACCESS changes end dates. Provisioned once approved; check list_access_request_statuses.

Generic approval, 3 operations

approve_generic_approvalApprove generic approvalPOSTApproves a generic approval on the live tenant as the caller (not access request ids); the approved change then proceeds. An admin who is not an approver takes over the approval from an approver.
get_generic_approvalGet generic approvalGETReturns one generic approval by its approval id (not an access request id): status, approvers, requester, reference and comments.
list_generic_approvalsList generic approvalsGETLists approvals of the generic approval service. Pass mine, approverId, requesterId or requesteeId; non-admins default to mine=true, admins see the whole org. Filter referenceType/referenceId.

Identity, 3 operations

delete_identityDelete identityDELETEPermanently deletes an identity from the live tenant. Call get_identity_ownership_details first: objects it owns must be reassigned before it can be deleted, and a protected identity is refused. Needs idn:identity:manage.
get_identityGet identityGETReturns one identity by id: name, emailAddress, identityStatus, lifecycleState, manager and processing state. Identity attribute maps are not returned. Needs idn:identity:read.
list_identitiesList identitiesGETLists identities (paged with limit/offset). Filter with filters, e.g. email eq "[email protected]"; identity attribute maps are not returned. Needs idn:identity:read.

Non employee approval, 3 operations

approve_non_employee_requestApprove non employee requestPOSTApproves a non-employee approval item on the live tenant and notifies the next approver; once every approver has approved, the non-employee record is created. The caller must be the requested approver.
get_non_employee_approvalGet non employee approvalGETReturns one non-employee approval item: approval status, approver, comment and the request it decides. Phone and custom attributes are not returned.
list_non_employee_approvalsList non employee approvalsGETLists non-employee approval items (pending, approved, rejected) of the caller, or of requested-for with idn:nesr:read.

Non employee request, 3 operations

create_non_employee_requestCreate non employee requestPOSTCreates a non-employee request and notifies its approver; the record is created once approved. Needs idn:nesr:create or ownership of the source.
get_non_employee_requestGet non employee requestGETReturns one non-employee request with its approval status and the requested record's details. Phone and custom attributes are not returned.
list_non_employee_requestsList non employee requestsGETLists non-employee requests for an account manager: requested-for is the manager's id, or "me" for the caller. Phone and custom attributes are not returned.

Tagged object, 3 operations

get_tagged_objectGet tagged objectGETReturns the tags of one object, given its type and id.
list_tagged_objectsList tagged objectsGETLists every tagged object with its tags (object reference type, id, name).
list_tagged_objects_by_typeList tagged objects by typeGETLists the tagged objects of one type (ROLE, ACCESS_PROFILE, ENTITLEMENT, IDENTITY, SOURCE...).

Account activity, 2 operations

get_account_activityGet account activityGETReturns one account activity by id, with its status, requester, recipient, items and errors. The id is also the access request tracking number.
list_account_activitiesList account activitiesGETLists account activities (access requests, provisioning, certifications remediation...) with their status and items; filter by requested-for, requested-by, type. Needs ORG_ADMIN or API.

Account entitlement, 2 operations

list_account_entitlementsList account entitlementsGETLists the entitlements of one account (paged with limit/offset).
list_entitlements_by_accountList entitlements by accountGETLists all entitlements of one account (404 when the account does not exist). ORG_ADMIN only.

Campaign template, 2 operations

get_campaign_templateGet campaign templateGETReturns one certification campaign template with its full campaign definition.
list_campaign_templatesList campaign templatesGETLists certification campaign templates (name, description, campaign definition, created, modified).

Certification, 2 operations

get_certificationGet certificationGETReturns one identity certification: campaign, phase, due date, reviewer, decisions made and identities/items completed. ORG_ADMIN, CERT_ADMIN or its reviewers.
list_certificationsList certificationsGETLists identity campaign certifications the caller may review (filter by campaign.id, phase, completed...). Certifications assigned to governance groups are not supported.

Certification review item, 2 operations

decide_certification_itemsDecide certification itemsPOSTRecords approve or revoke decisions on 1 to 250 review items of a certification on the live tenant. REVOKE removes the access once the certification is signed off with sign_off_certification. Reviewers, ORG_ADMIN or CERT_ADMIN.
list_certification_review_itemsList certification review itemsGETLists the access review items of a certification (identity + access to approve or revoke); their ids feed decide_certification_items. Not for governance-group certifications.

Entitlement, 2 operations

get_entitlementGet entitlementGETReturns one entitlement by id: source, attribute and value, requestable, privilege level, owner, segments and access model metadata.
list_entitlementsList entitlementsGETLists entitlements (groups, permissions) across sources, paged. Filter by source.id, name, requestable...; account-id or segmented-for-identity narrow the list. Any token can call it.

Governance group member, 2 operations

add_governance_group_membersAdd governance group membersPOSTAdds identities to a governance group on the live tenant; they can then act on the approvals, certifications and objects the group owns. Answers per identity with its status. Needs API or ORG_ADMIN authority.
list_governance_group_membersList governance group membersGETLists the members of a governance group (id, name, email).

Identity account, 2 operations

disable_identity_accountsDisable identity accountsPOSTSubmits a task on the live tenant that disables the SailPoint (IdentityNow) account of one identity, blocking its login. ORG_ADMIN only.
enable_identity_accountsEnable identity accountsPOSTSubmits a task on the live tenant that enables the SailPoint (IdentityNow) account of one identity, letting it log in again. ORG_ADMIN only.

Identity profile, 2 operations

get_identity_profileGet identity profileGETReturns one identity profile by id, with its authoritative source, attribute mapping and whether identities need refreshing (identityRefreshRequired).
list_identity_profilesList identity profilesGETLists identity profiles: name, authoritative source, priority, identity count, owner and attribute mapping configuration. Needs ORG_ADMIN or API authority.

Identity role assignment, 2 operations

get_identity_role_assignmentGet identity role assignmentGETReturns one role assignment of an identity: the role, how it was assigned (requested, criteria), assigner, dates and the accounts it targets.
list_identity_role_assignmentsList identity role assignmentsGETLists an identity's role assignments. Pass roleId or roleName to get full assignments for that role; with neither you get assignment references.

Lifecycle state, 2 operations

get_lifecycle_stateGet lifecycle stateGETReturns one lifecycle state of an identity profile: enabled, identity state, access profiles granted, account actions and email notification settings. ORG_ADMIN only.
list_lifecycle_statesList lifecycle statesGETLists the lifecycle states of an identity profile (id, name, technical name, enabled, access profiles and account actions). The id feeds set_lifecycle_state. ORG_ADMIN only.

Non employee source, 2 operations

get_non_employee_sourceGet non employee sourceGETReturns one non-employee source: name, description, owner, account managers and approvers.
list_non_employee_sourcesList non employee sourcesGETLists non-employee sources: requested-for is an account manager id or "me" (sources the caller owns). ORG_ADMIN or idn:nesr:read for other managers.

Object tag, 2 operations

add_tags_to_objectsAdd tags to objectsPOSTAdds tags to several objects. operation APPEND (default) keeps existing tags, MERGE replaces them with the tags sent.
delete_object_tagsDelete object tagsDELETERemoves all tags from one object on the live tenant.

Search document, 2 operations

aggregate_searchAggregate searchPOSTRuns a search aggregation (DSL aggregationsDsl or SailPoint aggregations) over an index and returns the aggregation buckets and hits.
get_search_documentGet search documentGETReturns one document from a search index (identities, roles, entitlements, events, accountactivities, accessprofiles) by its id.

Sod policy, 2 operations

get_sod_policyGet sod policyGETReturns one SOD policy: type, state, owner, conflicting access criteria, mitigating controls and violation owner. ORG_ADMIN or SOD_POLICY_ADMIN.
list_sod_policiesList sod policiesGETLists separation-of-duties (SOD) policies: name, type, state, owner, conflicting access criteria and violation owner. ORG_ADMIN or SOD_POLICY_ADMIN.

Source, 2 operations

get_sourceGet sourceGETReturns one source by id: type, connector, owner, management workgroup, cluster, status and features. Connector configuration is not returned.
list_sourcesList sourcesGETLists sources (connected systems): name, type, connector, owner, status, health and features. Connector configuration is not returned. Filter by name, type or owner.

Source schema, 2 operations

get_source_schemaGet source schemaGETReturns one schema of a source, with its native object type, identity attribute and attribute definitions.
list_source_schemasList source schemasGETLists the schemas of a source (account, group...) with their identity, display and hierarchy attributes and attribute definitions.

Work item approval item, 2 operations

approve_all_work_item_approval_itemsApprove all work item approval itemsPOSTApproves all approval items of a work item at once on the live tenant. Only an admin or the work item owner.
approve_work_item_approval_itemApprove work item approval itemPOSTApproves one approval item of a work item on the live tenant (ids from get_work_item). Only an admin or the work item owner.

Workflow execution, 2 operations

cancel_workflow_executionCancel workflow executionPOSTCancels a running workflow execution on the live tenant; steps already run are not undone.
get_workflow_executionGet workflow executionGETReturns one workflow execution: workflow id, status, start and close times. Executions are archived after 90 days (404).

Access profile entitlement, 1 operation

list_access_profile_entitlementsList access profile entitlementsGETLists the entitlements of an access profile (paged). A SOURCE_SUBADMIN must have access to its source.

Access request approver, 1 operation

list_access_request_approversList access request approversGETLists the approvers of one access request. ORG_ADMIN only.

Access request status, 1 operation

list_access_request_statusesList access request statusesGETLists access request statuses (state, requested item, approvals, errors). Requests for access already held are ignored and not listed. Other users' requests need ORG_ADMIN.

Account aggregation status, 1 operation

get_account_aggregation_statusGet account aggregation statusGETReturns the status of an in-progress account aggregation: status and counts of new, changed and deleted accounts found and processed so far.

Campaign report, 1 operation

list_campaign_reportsList campaign reportsGETLists the reports of a certification campaign (type, status, last run, file name). Their task results can be fetched with download_report.

Certification reviewer, 1 operation

list_certification_reviewersList certification reviewersGETLists the reviewers of a certification. ORG_ADMIN, CERT_ADMIN or its reviewers.

Identity attribute, 1 operation

list_identity_attributesList identity attributesGETLists the identity attributes defined in the tenant (name, display name, type, searchable, system, sources). includeSystem and includeSilent widen the list.

Identity entitlement, 1 operation

list_identity_entitlementsList identity entitlementsGETLists every entitlement an identity holds, directly or through a role or access profile. Needs ORG_ADMIN or API authority.

Identity ownership, 1 operation

get_identity_ownership_detailsGet identity ownership detailsGETLists the objects an identity owns (roles, access profiles, sources, governance groups...) that block deleting it; reassign them first. For every owned object, search the identities index (owns field).

Public identity, 1 operation

list_public_identitiesList public identitiesGETLists public identities (id, name, alias, email, status, manager and the attributes the org made public). Any user can call it; add-core-filters=true hides incomplete identities.

Report, 1 operation

download_reportDownload reportGETDownloads the file of a finished report (taskResultId = id returned by run_report; check get_report_result first) as CSV (default) or PDF, stored as a file.

Report result, 1 operation

get_report_resultGet report resultGETReturns the result of a report that was run or is running (taskResultId = id returned by run_report): status, report type, timing and row counts.

Requestable object, 1 operation

list_requestable_objectsList requestable objectsGETLists roles and access profiles that can be requested, each marked AVAILABLE, PENDING or ASSIGNED for the identity given in identity-id. For entitlements use list_entitlements.

Role assigned identity, 1 operation

list_role_assigned_identitiesList role assigned identitiesGETLists the identities that hold a role (id, name, alias, email, role assignment source).

Role entitlement, 1 operation

list_role_entitlementsList role entitlementsGETLists the entitlements granted by a role (paged).

Source health, 1 operation

get_source_healthGet source healthGETReturns the health of one source: status (healthy or not), its type, connector and the last health check time.

Source schedule, 1 operation

list_source_schedulesList source schedulesGETLists the schedules of a source (account aggregation, group aggregation...) with their cron expression; days of the week are 1-7 (Sunday-Saturday).

Tag, 1 operation

list_tagsList tagsGETLists the tags defined in the tenant (name, id, tagged object references). Needs API, ORG_ADMIN, CERT_ADMIN, REPORT_ADMIN, ROLE_ADMIN, ROLE_SUBADMIN, SOURCE_ADMIN or SOURCE_SUBADMIN.

Task status, 1 operation

get_task_statusGet task statusGETReturns the status of one task (aggregation, account action, report...): completion status, progress, messages and timestamps. Tasks older than 90 days are not returned.

Tenant, 1 operation

get_tenantGet tenantGETReturns the tenant: id, name, full name, pod, region, description and the licensed products with their URLs. Any token can call it.

Transform, 1 operation

get_transformGet transformGETReturns one transform by id: name, type and its configuration attributes.

Violation, 1 operation

get_violationGet violationGETReturns one policy violation. Allowed with idn:sod-violation:read or as an owner of the violation (directly or through a governance group); 403 otherwise.

Workflow, 1 operation

get_workflowGet workflowGETReturns one workflow: name, owner, enabled, trigger and execution counts. Step definitions are not returned.

Workflow execution history, 1 operation

get_workflow_execution_historyGet workflow execution historyGETReturns the event history of a workflow execution (step started, completed, failed, with timestamps). Event payload attributes are not returned. Archived after 90 days (404).

Showing the first 120 of 153 endpoints. The rest are in the product, searchable from the workflow builder and from chat.

Use SailPoint Identity Security Cloud from Claude Code, Cursor or Codex

Connect SailPoint Identity Security Cloud in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its SailPoint Identity Security Cloud operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect SailPoint Identity Security Cloud

Create your workspace
Sign up free. Nothing to install.
Connect SailPoint Identity Security Cloud once
Add your SailPoint Identity Security Cloud connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.