SailPoint (Identity Security Cloud)
SailPoint·AE_HSc_SailPoint_RestConnectorGuide
Overview
The SailPoint connector integrates AlertEnterprise Guardian with SailPoint Identity Security Cloud (formerly SailPoint IdentityNow) — the dominant Identity Governance & Administration (IGA) platform in the Fortune 500 financial services and federal verticals. SailPoint sits "above" the IAM directory layer (Okta, Entra) and governs the full identity-lifecycle workflow — birthright provisioning, access reviews, certifications, and SOD policy enforcement.
The integration is read-only — reconciliation only, no provisioning. AE consumes SailPoint as a source of identity events and lifecycle state but does not provision into it. Capabilities: Test Connection, Full User Recon, Incremental User Recon. The intended pattern is: SailPoint owns the identity lifecycle (new hire, transfer, termination); AE polls SailPoint at a configurable interval (typically every 15 minutes), detects qualifying events (new hire, change of department, termination), and triggers AE Guardian workflows downstream — most commonly to provision the new hire's access into one or more PACS or to remove access at termination.
The connector is actively iterated — 6 revisions between September 2025 and April 2026 with active updates to system parameters and query payloads. Customers deploying this connector should verify against the latest revision.
Architecture
Composed from this connector's actors + edges. Trust zones are color-coded; trust crossings render as thicker lines.
Authentication
1 method supported
The connector authenticates to SailPoint via OAuth 2.0 client credentials grant. Tenant admin generates a Personal Access Token (or app-registration-style client_id + client_secret) in SailPoint admin. The connector posts to /oauth/token?grant_type=client_credentials with client_id + client_secret and uses the returned bearer token on subsequent API calls.
Endpoints
2 endpoints exercised by the connector
| Method | Path | Description | Category |
|---|---|---|---|
| POST | {instance}/oauth/token?grant_type=client_credentials | OAuth 2.0 token exchange. | auth |
| POST | {instance}/v3/search | Search SailPoint identity events / identities — used for new-hire detection and incremental reconciliation. Indices include `events`, `identities`. | query |
Prerequisites
Everything that must be in place for this connector to work, with the owner who's responsible.
SailPoint Identity Security Cloud tenant with Public API access
customerAn operational SailPoint Identity Security Cloud tenant. Tenant admin must enable Public API access and generate OAuth client credentials.
AE Guardian workflows mapped to SailPoint event types
aeAE Guardian-side workflow mappings must be configured for the events of interest — new hire, identity-attribute change, termination. Without these mappings, polling SailPoint produces events that AE doesn't act on.
Known limitations
Documented constraints to set customer expectations before deployment.
Reconciliation only (no provisioning back to SailPoint)
importantThe connector reads from SailPoint but does not write into it. SailPoint remains the authority for the identity lifecycle; AE consumes events and acts on them downstream. If a deployment requires AE to push into SailPoint, that requires custom connector development.
Active iteration — track guide revisions
informational6 revisions in 8 months (Sept 2025 - April 2026), with active updates to system parameters and query payloads. Verify against the latest connector guide revision before each deployment and after each SailPoint platform update.
IAM specifics
- OIDC
- yes
- SAML
- yes
- SCIM
- yes · SCIM 2.0
- JIT provisioning
- configurable
- Group sync mode
- not-supported
- Source of record
- Yes
SailPoint defers MFA to the upstream IdP (Okta, Entra ID). The connector reads identity state from SailPoint but does not configure or enforce MFA itself.
SailPoint identity attributes — id, name, email, employeeNumber, department, manager, lifecycleState, status. AE-side mapping is configurable.
- src/connectors/sail-point-rest/source.pdf — Full connector guide — 32 pages, revision 6.0 dated 2026-04-06
- src/connectors/sail-point-rest/source.pdf — p7 — Connector Architecture
- src/connectors/sail-point-rest/source.pdf — p7 — Integration Mechanism / Polling Schedule