1Kosmos Workflow: Identity Verification

After the user clicks the verification link in the email from SailPoint, they are redirected to the 1Kosmos platform to complete the Identity Verification process. Once the user completes their identity verification the 1Kosmos workflow invokes a SailPoint endpoint.

The 1Kosmos workflow is built in 1Kosmos's own workflow builder. It's what actually runs when the user clicks their verification link, and it's responsible for calling back to SailPoint Workflow 2 when it's done.

Configure the Verification Flow

The verification flow defines what "verified" means for your organization, for example, which claims to check (name, date of birth), how strictly they must match (exact vs. fuzzy), and how long a session stays valid before expiring. During verification, 1Kosmos compares the claims sent by SailPoint against the data extracted from the user's identity document using this configuration. For setup instructions, see Configuring Verification Flows in the 1Kosmos documentation. Your 1Kosmos representative can help you determine the right settings for your use case.

Configure the Workflow Steps

Build the sequence of verification steps the user goes through, for example: scan ID, take a selfie, liveness check, using the verification flow to determine what's being checked at each step. Make a note of the workflow access code that is generated when the workflow is created. This is the workflowId referenced in Sailpoint Workflow 1. For setup instructions, see Workflow Builder in the 1Kosmos documentation.

Configure the Callback to SailPoint

As the final step in the 1Kosmos workflow, add a step that calls the SailPoint external trigger endpoint, passing the workflow instance ID. This is what starts Workflow 2 in SailPoint.

POST https://{tenant}.api.{domain}.com/beta/workflows/execute/external/{external_trigger_id}

Authorization: Bearer {external_trigger_access_token}

Content-Type: application/json

{

"wfInstanceId": "{wfInstanceId}"

}

Authenticate this call using the OAuth 2.0 client_credentials grant, with the client ID and client secret from the External Trigger step you configured in Sailpoint Workflow 2.