Leveraging the APIs to build missing certifications

Jeffrey Milanovich demonstrates how to leverage SailPoint's Python SDK and APIs to build a non-standard "access owner" certification that cannot be achieved using out-of-the-box configuration alone 3:34-3:45.

Key Takeaways:
• Out-of-the-box SailPoint certifications only support individual, governance group, or manager as certifiers, meaning access owners cannot natively certify their own entitlements 6:15-6:34.
• While workflows were considered, the 250-iteration loop limit made them unviable for large campaigns, leading to the selection of the Python SDK for its ability to chain API calls and handle complex logic 9:49-10:48.
• The solution creates a search-based access certification assigned to a placeholder governance group, then uses a Python script to programmatically reassign each access item to its actual owner 14:02-15:48.
• The script includes safeguards like a default certifier fallback for unowned items and a check to prevent assigning a user as both reviewer and reviewee 20:18-21:57.

This approach provides a repeatable, auditable method to consolidate access reviews into a single campaign. Future enhancements could include full automation via Lambda triggers or building a custom UI with SailPoint's UI toolkit 26:41-27:34.

Sources:

• 3:34-3:45 Introduction of the access owner certification use case
• 6:15-6:34 Limitations of out-of-the-box certifier options
• 9:49-10:48 Why the Python SDK was chosen over workflows
• 14:02-15:48 Setting up the base search-based certification with a governance group
• 20:18-21:57 Handling default certifiers and preventing self-review conflicts
• 26:41-27:34 Future improvements like automation and templating