SailPoint integration

• ServiceNow: admin, IntegrationHub, and the Service Catalog.
• SailPoint: admin access; for ISC an API client (PAT), for IdentityIQ the SCIM/REST endpoint and a service account.
• SailPoint's pre-built ServiceNow Service Desk integration module (optional but recommended).

• ISC: Admin → API Management → New personal access token with idn:accessrequest scopes.
• IdentityIQ: create a service account with rights to the SCIM 2.0 API.

• Create an OAuth 2.0 (client credentials) or Basic Auth credential and a Connection to the SailPoint tenant base URL.
• Attach to a Connection & Credential alias used by your flow.

• Create a catalog item 'Request application access' with variables for user and entitlement/role.
• Map the ServiceNow user to the SailPoint identity by email or employee_number.

POST {tenant}/v3/access-requests
{
  "requestedFor": ["<identityId>"],
  "requestType": "GRANT_ACCESS",
  "requestedItems": [{ "type": "ACCESS_PROFILE", "id": "<accessProfileId>" }]
}

• Trigger the flow on catalog task approval; call the access-request API above.
• Store the returned request id on the RITM for tracking.

• Poll the request status API (or receive a SailPoint webhook) and close the ServiceNow task when provisioning completes.
• Optionally trigger/receive certification campaigns and record outcomes.

• Submit a test access request; confirm SailPoint provisions and the task closes on completion.

• Identity not found: mapping key mismatch (email vs employee id).
• 401: PAT scopes insufficient.
• Stuck tasks: provisioning pending manual approval in SailPoint, surface that status.