Initial Sailpoint set up

Before configuration, check for the following:

• Admin access to your SailPoint ISC tenant, including access to SaaS Workflows

• Admin access to your 1Kosmos tenant/community

• 1Kosmos API credentials for your tenant: keyId, keySecret, license, tenant_id, community_id, and your host

SailPoint ISC — Create a Source

The integration requires a dedicated source in SailPoint ISC to store Identity Verification status attributes for each identity. This source is non-authoritative — it holds IDV outcome data that SailPoint surfaces at the identity level to inform access decisions. For instructions on creating and configuring a source in SailPoint ISC, see Configuring Sources.

In your source, use the following attributes:

Attribute	Description
id	1Kosmos workflow instance ID. Used as the account identifier and nativeIdentity. If the workflow is not complete, add this in
name	User's email address.
firstName	User's first name.
lastName	User's last name.
email	User's email address.
idvStatus	Current IDV status. Values: PENDING, COMPLETED.
idvStatusReason	Reason associated with the IDV status. Mapping from result_summary to be determined — not currently populated.
createDate	Date the record was created.
updateDate	Date the record was last updated.

Identity Profile Configuration

Add idvStatus and idvStatusReason attributes to the Identity Profiles that govern the target identities and configure the attribute mappings to retrieve these values from the source.

SailPoint Personal Access Token (PAT)

Create a Personal Access Token in SailPoint with the following OAuth scopes:

• idn:accounts:read

• idn:accounts:manage

Creating the PAT gives you a client ID and client secret. You'll use these to obtain a bearer token before making any SailPoint API calls (see Section 2.4). Full instructions and a runnable example are in the SailPoint API reference and the Postman collection.

Authenticate to the SailPoint API

The HTTP Request steps used in both workflows call the SailPoint API directly, so each one needs a bearer token. Tokens are obtained via the OAuth 2.0 client_credentials grant, using the PAT from Section 2.3.

Token request

POST https://{tenant}.api.{domain}.com/oauth/token

Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id={pat_client_id}&client_secret={pat_client_secret}

Token response

{

"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",

"token_type": "Bearer",

"expires_in": 750

}

Include the token on every subsequent SailPoint API call

Authorization: Bearer {access_token} 

For a complete working example, see the SailPoint API reference and the Postman collection.