ServiceNow SailPoint Integration: Requests

ServiceNow SailPoint integration

Automate access requests and certifications with SailPoint IGA.

Quick answer

SailPoint owns who should have access; ServiceNow is the front door. Create a personal access token in Identity Security Cloud or a SCIM service account in IdentityIQ, and build a catalog item keyed to the SailPoint identity by email or employee number. On approval a flow posts to the access-requests API and stores the request id on the RITM.

Key takeaways

Prerequisites
Step 1, Create SailPoint API credentials
Step 2, Connection & alias
Step 3, Model the request
Step 4, Outbound provisioning flow

Connect ServiceNow access requests to SailPoint (IdentityIQ or Identity Security Cloud) so catalog requests provision access and certifications are automated.

Prerequisites

ServiceNow: admin, IntegrationHub, and the Service Catalog.
SailPoint: admin access; for ISC an API client (PAT), for IdentityIQ the SCIM/REST endpoint and a service account.
SailPoint's pre-built ServiceNow Service Desk integration module (optional but recommended).

Step 1, Create SailPoint API credentials

ISC: Admin → API Management → New personal access token with idn:accessrequest scopes.
IdentityIQ: create a service account with rights to the SCIM 2.0 API.

Step 2, Connection & alias

Create an OAuth 2.0 (client credentials) or Basic Auth credential and a Connection to the SailPoint tenant base URL.
Attach to a Connection & Credential alias used by your flow.

Step 3, Model the request

Create a catalog item 'Request application access' with variables for user and entitlement/role.
Map the ServiceNow user to the SailPoint identity by email or employee_number.

Step 4, Outbound provisioning flow

POST {tenant}/v3/access-requests
{
  "requestedFor": ["<identityId>"],
  "requestType": "GRANT_ACCESS",
  "requestedItems": [{ "type": "ACCESS_PROFILE", "id": "<accessProfileId>" }]
}

Trigger the flow on catalog task approval; call the access-request API above.
Store the returned request id on the RITM for tracking.

Step 5, Status back & certifications

Poll the request status API (or receive a SailPoint webhook) and close the ServiceNow task when provisioning completes.
Optionally trigger/receive certification campaigns and record outcomes.

Step 6, Test & promote

Submit a test access request; confirm SailPoint provisions and the task closes on completion.

Troubleshooting

Identity not found: mapping key mismatch (email vs employee id).
401: PAT scopes insufficient.
Stuck tasks: provisioning pending manual approval in SailPoint, surface that status.

SailPoint owns who should have access; ServiceNow is the request/approval front door.