Workflow 1: Enroll a New Identity for Verification

This workflow starts a verification session in 1Kosmos, creates a matching account in the source, and emails the user a link to begin verification.

Steps

#	Step	SailPoint Step Type
1	Identity Created	Trigger
2	Create 1Kosmos Workflow Instance	HTTP Request
3	Create Account	Create Account
4	Send Verification Email	Send Email

Identity Created

Set the workflow trigger to Identity Created. This fires whenever a new identity is created in SailPoint from any of your sources, and makes that identity's attributes (email, first name, last name, identity ID) available to the rest of the workflow.

Create 1Kosmos Workflow Instance

Add an HTTP Request step that calls the 1Kosmos Create Workflow Instance API to start a new IDV session for the user, using the trigger data from Step 1.

POST https://{1kosmos_host}/workflowapi/workflow_instance/tenant/{tenant_id}/community/{community_id}/create

Accept: application/json

Content-Type: application/json

keyId: {keyId}

keySecret: {keySecret}

license: {license}

requestfromswagger: true

{

"data": {

"metaData": {

"email": "{{$.trigger.attributes.email}}",

"firstName": "{{$.trigger.attributes.firstname}}",

"identityId": "{{$.trigger.identity.id}}",

"lastName": "{{$.trigger.attributes.lastname}}"

},

"workflowId": "{your 1Kosmos workflowId}"

}

}

Response

{

"data": {

"wfInstanceId": "wfi-abc123-def456-ghi789",

"wfInstanceUrl": "https://{1kosmos_host}/workflow/wf_instance/wfi-abc123-def456-ghi789"

}

}

Create Account

Add a Create Account step in the workflow. This will create an account in the source using the trigger data from Step 1 and the wfInstanceId returned in Step 2.

POST https://{tenant}.api.{domain}.com/v3/accounts

Authorization: Bearer {access_token}

Content-Type: application/json

{

"attributes": {

"createDate": "{{$.now()}}",

"email": "{{$.trigger.attributes.email}}",

"lastName": "{{$.trigger.attributes.lastname}}",

"firstName": "{{$.trigger.attributes.firstname}}",

"id": "{{$.hTTPRequest.body.data.wfInstanceId}}",

"idvStatus": "PENDING",

"name": "{{$.trigger.attributes.email}}",

"sourceId": "{your source ID}"

},

"identityId": "{{$.trigger.identity.id}}"

}

The id value you set here becomes the account's nativeIdentity in SailPoint (SailPoint separately generates its own internal account ID). Workflow 2 uses nativeIdentity as the key to find this account again, so it must match the wfInstanceId from Step 2.

Send Verification Email

Add a Send Email step to notify the user:

• Recipient: identity.attributes.email
• Link: the wfInstanceUrl returned in Step 2