REST API
Quick answer
The REST API is the primary programmatic interface to SailPoint, returning JSON over HTTPS with OAuth-based authentication.
Key takeaways
- JSON over HTTPS, OAuth secured
- Covers identities, access, certifications, sources
- Supports filtering, sorting and pagination
- The modern way to integrate with SailPoint
The REST API is the primary programmatic interface to SailPoint. It returns JSON over HTTPS, is secured with OAuth, and exposes the objects you work with in the UI, identities, accounts, entitlements, access requests, certifications, sources, so that automation, custom portals and integrations can do anything a user can, at scale.
What the REST API covers
The API is broad and versioned. Typical resource areas include public identities and full identity detail, accounts and entitlements, access requests and their status, certifications and campaigns, sources/applications, and configuration objects. In SailPoint Identity Security Cloud these are the well-documented v3/beta endpoints; IdentityIQ exposes its own REST API for the same purposes.
Authentication
Every call carries an OAuth bearer token. A service integration obtains a token using the client-credentials grant, then sends it on each request:
curl -H "Authorization: Bearer $TOKEN" \
"https://tenant.api.identitynow.com/v3/public-identities?filters=alias eq \"jdoe\""Working with collections
List endpoints support server-side filtering, sorting and pagination. Always filter to what you need and page through large result sets rather than pulling everything, this is faster, cheaper and avoids rate limits. Read the total count from the response headers to know when you have all records.
Why REST over SOAP
The REST API is the modern, actively-developed interface. It uses JSON, integrates with every language and tool, is well documented, and is what the SDKs and Postman collections target. Reserve the older SOAP interface for legacy integrations that have no REST equivalent.
Practical guidance
- Cache and refresh tokens rather than authenticating on every call.
- Handle
429(rate limit) and5xxwith exponential backoff. - Prefer the official SDKs, which wrap auth, pagination and retries.
Common pitfalls
- Pulling entire collections instead of filtering server-side.
- Ignoring pagination, missing records beyond the first page.
- Hard-coding tokens instead of obtaining them via OAuth.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What format does the REST API return?
- A. With OAuth, obtaining a bearer token that is sent on each request.
- B. JSON over HTTPS.
- C. REST is the modern, JSON-based, well-supported interface for automation and custom UIs.
Show answer
B. JSON over HTTPS.
JSON over HTTPS.
How do you authenticate to the REST API?
- A. REST is the modern, JSON-based, well-supported interface for automation and custom UIs.
- B. With OAuth, obtaining a bearer token that is sent on each request.
- C. JSON over HTTPS.
Show answer
B. With OAuth, obtaining a bearer token that is sent on each request.
With OAuth, obtaining a bearer token that is sent on each request.
Why prefer REST over SOAP?
- A. REST is the modern, JSON-based, well-supported interface for automation and custom UIs.
- B. JSON over HTTPS.
- C. With OAuth, obtaining a bearer token that is sent on each request.
Show answer
A. REST is the modern, JSON-based, well-supported interface for automation and custom UIs.
REST is the modern, JSON-based, well-supported interface for automation and custom UIs.