Ellipse Gradient for Header

SailPoint Integration Guide

Integrate SailPoint Identity Security Cloud and IdentityIQ with enterprise systems through REST APIs, OAuth 2.0, selected event notifications, and orchestrated identity workflows.

SailPoint integration options at a glance

SailPoint Identity Security Cloud is primarily integrated through tenant-specific REST APIs secured with OAuth 2.0, while IdentityIQ provides REST capabilities that depend on its deployed version and configuration. Identity Security Cloud also supports event triggers and HTTP-based callbacks for selected events, allowing Martini to receive notifications and retrieve current resource state. Some aggregation, provisioning, and administrative operations can be asynchronous or long-running and require status polling. IdentityIQ may expose deployment-specific database access or legacy web services, but supported APIs should generally be preferred. Martini can consume these APIs, manage secrets, transform identity data, orchestrate workflows, expose APIs, and implement retries and checkpoints.

Integration pointSupported by SailPoint?Common use casesHow Martini supports it
REST APIsYesIdentity Security Cloud uses versioned REST APIs for identities, accounts, sources, entitlements, roles, access profiles, requests, certifications, lifecycle states, workflows, and related administration. IdentityIQ also provides REST capabilities subject to deployment and version.Martini can consume SailPoint REST APIs from workflows, map and transform responses, apply business rules, and expose REST APIs that abstract SailPoint operations.
AuthenticationYesIdentity Security Cloud uses OAuth 2.0 client credentials, tenant-specific token endpoints, scoped access, and bearer tokens. IdentityIQ authentication depends on its configured security model and service-account permissions.Martini stores tenant URLs, client credentials, scopes, and other configuration as protected environment settings and uses authenticated API consumption.
Webhooks / outbound callbacksLimitedIdentity Security Cloud event triggers and HTTP-based callbacks support selected events and workflow scenarios rather than universal notifications for every object or state change.Martini can expose an API endpoint or webhook-triggered workflow, validate notifications, retrieve current SailPoint state, and apply idempotency rules.
Bulk / asynchronous operationsLimitedAggregation, provisioning, access processing, and other administrative operations may process multiple objects or run longer than the initial request. Behavior varies by resource.Martini can capture operation identifiers, poll status, persist checkpoints, retry transient failures, and avoid duplicate submissions.
SOAP APIsLegacyIdentityIQ or legacy deployments may contain web-service interfaces, but SOAP is not the primary approach for new Identity Security Cloud integrations and must be verified by product version.Martini can consume SOAP services when a specific IdentityIQ deployment documents and exposes them, while keeping the integration separate from current REST workflows.
Database / analytics accessLimitedIdentityIQ may use a customer-managed relational database, making read-only reporting or specialized internal integration possible after schema and support implications are confirmed. This does not apply to Identity Security Cloud.Martini can connect to supported databases when the deployment authorizes it, but API-based access should generally be preferred, especially for writes and provisioning.
File / attachment APIsNot confirmedNo general-purpose file or attachment API was confirmed as a primary SailPoint integration mechanism. File exchange may apply to particular IdentityIQ or source implementations.Martini can process files when a specific SailPoint implementation provides a supported file location or transfer endpoint, but this should be designed and verified case by case.

How SailPoint exposes data and business events

SailPoint REST APIs

REST is SailPoint Identity Security Cloud's primary integration mechanism and is also available for IdentityIQ integrations subject to product version and deployment configuration. APIs cover identity management, accounts, sources, entitlements, roles, access requests, certifications, lifecycle states, workflows, and related operations.

Martini implementation pattern

Martini implementation pattern: a workflow or API invokes the appropriate SailPoint REST endpoint using protected OAuth configuration, validates the response, maps the vendor object to a canonical model, applies business rules, and writes the result to the target system. Product-specific endpoint and schema configuration should remain separate for Identity Security Cloud and IdentityIQ.

Implementation sequence

Authenticate with the tenant or IdentityIQ API configuration
Invoke the documented SailPoint REST resource
Validate the response and capture correlation identifiers
Map the SailPoint object to the target model
Apply identity, access, and business rules
Write the result to the target system and record the outcome

SailPoint Event Triggers

Identity Security Cloud supports event triggers and HTTP-based workflow or callback patterns for selected events. Coverage is event-specific, so integrations should verify whether the required identity, account, request, or certification event is available.

Martini implementation pattern

Martini implementation pattern: expose a secured Martini API endpoint or webhook-triggered workflow, validate the notification, use its identifier to retrieve current SailPoint state, and process the authoritative resource rather than relying only on the event payload. Duplicate, delayed, and out-of-order notifications should be expected.

Implementation sequence

Receive the SailPoint event notification
Validate the event source, payload, and signature or credentials where configured
Extract the referenced SailPoint identifier
Retrieve the current SailPoint resource through the REST API
Apply idempotency and business rules
Synchronize the result and store the processing status

Bulk and Asynchronous Operations

Some SailPoint aggregation, provisioning, access-processing, and administrative operations may be long-running or process multiple objects. Operation behavior and status resources vary by API resource.

Martini implementation pattern

Martini implementation pattern: submit the operation once, capture its task or operation identifier, and use a delayed or scheduled workflow to poll status. Martini can checkpoint progress, apply bounded retries, and route terminal failures for review without resubmitting completed work.

Implementation sequence

Submit the SailPoint operation with a correlation key
Capture the returned operation or task identifier
Persist the identifier and initial processing state
Poll the documented status resource after an appropriate delay
Handle completion, failure, or timeout according to business rules
Publish the final result and retain an audit reference

IdentityIQ Web Services

IdentityIQ deployments may contain legacy or product-specific web-service interfaces, including possible SOAP capabilities. These are not the primary integration approach for current Identity Security Cloud and must be verified against the deployed IdentityIQ version.

Martini implementation pattern

Martini implementation pattern: when a supported IdentityIQ deployment exposes a required SOAP or other web-service operation, Martini consumes it through a product-specific workflow, maps the response, and isolates legacy behavior from REST-based Identity Security Cloud assets. API and security configuration must be confirmed before implementation.

Implementation sequence

Confirm the IdentityIQ version and exposed web-service contract
Configure the deployment-specific authentication
Invoke the documented service operation
Transform the response into a canonical identity or access model
Apply validation and authorization rules
Record the service result and route failures for investigation

Common SailPoint integration patterns

Pattern 1: Synchronize joiner, mover, and leaver changes

When to use this pattern

Use this pattern when workforce changes from Workday or Oracle HCM Cloud must update SailPoint Identities and lifecycle states, with downstream account provisioning or status reporting. The workflow should correlate stable worker identifiers rather than relying only on names or email addresses.

Integration direction
Workday
Martini
SailPoint
Example Mapping
SailPoint FieldCanonical FieldTarget Field
workerIdperson.externalIdIdentity.id or correlated identity attribute
employmentStatusperson.lifecycleStateLifecycle state
departmentorganization.departmentIdentity department
managerIdperson.managerExternalIdIdentity manager
Martini implementation pattern

Martini receives a workforce event or runs an incremental schedule, validates the worker payload, locates or creates the appropriate Identity, and updates lifecycle attributes through SailPoint REST APIs. Business rules determine joiner, mover, and leaver handling; retries are limited to transient failures, while correlation and validation errors are routed for review.

Martini capabilities used
  • workflows
  • API consumption
  • data mapping
  • business rules
  • secrets management
  • error handling

Pattern 2: Orchestrate access requests

When to use this pattern

Use this pattern when ServiceNow or an internal access portal needs a controlled business-level API for requesting Roles, Entitlements, or Access Profiles in SailPoint.

Integration direction
ServiceNow
Martini
SailPoint
Example Mapping
SailPoint FieldCanonical FieldTarget Field
requestedForaccess.subjectIdIdentity.id
catalogItemaccess.requestedObjectRole, Entitlement, or Access Profile id
approvalReferenceaccess.approvalIdSailPoint access request correlation
requestStatusaccess.statusSailPoint request status
Martini implementation pattern

Martini exposes or consumes a REST API, validates the requester and requested access object, invokes SailPoint access-request operations, and monitors asynchronous status where required. It returns a stable business response to the calling application and prevents duplicate submissions using a request correlation key.

Martini capabilities used
  • API exposure
  • API consumption
  • data mapping
  • validation
  • business rules
  • asynchronous workflows
  • error handling

Pattern 3: Synchronize certification remediation

When to use this pattern

Use this pattern when active Access Certifications and reviewer decisions must create remediation work in ServiceNow or Jira, with completed outcomes returned to SailPoint.

Integration direction
SailPoint
Martini
ServiceNow
Example Mapping
SailPoint FieldCanonical FieldTarget Field
certificationIdgovernance.campaignIdremediation campaign reference
certificationItemIdgovernance.reviewItemIdticket correlation key
decisiongovernance.reviewOutcomeremediation action
identityIdperson.identityIdticket subject reference
Martini implementation pattern

A scheduled Martini workflow retrieves active certification data, expands identities, accounts, entitlements, and decisions, then creates or updates remediation tasks. It tracks ticket identifiers and certification item identifiers, applies revocation rules only after the required business conditions are met, and retries safely using idempotent keys.

Martini capabilities used
  • scheduled workflows
  • API consumption
  • mapping and transformation
  • business rules
  • idempotent processing
  • monitoring

Pattern 4: Reconcile accounts and entitlements

When to use this pattern

Use this pattern for periodic comparisons between SailPoint Accounts, Entitlements, and Sources and a target application or reporting store. It is useful for identifying unmatched objects, ownership differences, and approved remediation actions.

Integration direction
SailPoint
Martini
Microsoft Entra ID
Example Mapping
SailPoint FieldCanonical FieldTarget Field
accountIdaccess.accountExternalIdaccount.id
sourceIdaccess.sourceExternalIdaccount.sourceId
entitlementIdaccess.entitlementExternalIdgroup.id or permission.id
owneraccess.ownerExternalIdresource.owner
Martini implementation pattern

Martini pages through SailPoint collections, optionally filters by modification time, normalizes identifiers, compares current state with the target, and applies only approved differences. Checkpoints, bounded concurrency, retry with backoff, and exception reporting make the reconciliation recoverable without repeatedly provisioning the same access.

Martini capabilities used
  • scheduled workflows
  • pagination
  • data mapping
  • business rules
  • checkpointing
  • retry handling

Applications commonly integrated with SailPoint

SailPoint commonly participates in identity lifecycle, access governance, provisioning, and remediation architectures. The following named applications represent typical integration scenarios; exact object coverage and provisioning behavior depend on the SailPoint product, version, source configuration, and application APIs.

Application Scenario Direction Martini Pattern
Workday Synchronize worker profiles, employment status, departments, managers, and joiner, mover, and leaver changes with SailPoint Identities. Workday → Martini → SailPoint Martini consumes worker changes or scheduled extracts, correlates them to SailPoint Identities, maps lifecycle attributes, and invokes SailPoint REST APIs with validation and retry handling.
ServiceNow Coordinate access requests, approval or fulfillment tasks, certification remediation, and identity governance exceptions. ServiceNow → Martini → SailPoint Martini exposes or consumes APIs for request and ticket workflows, validates Roles, Entitlements, or Access Profiles, invokes SailPoint operations, and synchronizes status and exceptions.
Microsoft Entra ID Govern users, groups, applications, and access associated with Microsoft cloud identities. Microsoft Entra ID → Martini → SailPoint Martini coordinates identity and account data between SailPoint and Microsoft Entra ID, normalizes identifiers, applies business rules, and handles asynchronous operations through checkpoints.
Active Directory Govern on-premises directory accounts, groups, and lifecycle changes through SailPoint source and account processes. Active Directory → Martini → SailPoint Martini synchronizes directory-related identity data, maps source-native account identifiers, and routes provisioning or reconciliation outcomes to downstream systems.
Salesforce Govern Salesforce users, profiles, permission sets, and related access assignments. Salesforce → Martini → SailPoint Martini maps SailPoint Accounts, Entitlements, and access decisions to Salesforce-facing processes, applies correlation rules, and records rejected or retried updates.
SAP S/4HANA Govern business users, roles, and entitlements in SAP environments. SAP S/4HANA → Martini → SailPoint Martini transforms SAP identity and role attributes into SailPoint-compatible data, invokes documented endpoints where configured, and separates product-specific mappings from shared workflow logic.
Oracle HCM Cloud Synchronize workforce data and employment changes for identity lifecycle processing. Oracle HCM Cloud → Martini → SailPoint Martini retrieves or receives workforce changes, correlates worker identifiers to SailPoint Identities, updates lifecycle attributes, and tracks processing outcomes.
Jira Route access fulfillment, certification remediation, and identity governance exceptions to development and operations teams. SailPoint → Martini → Jira Martini converts SailPoint certification or remediation outcomes into Jira issues, preserves SailPoint correlation identifiers, and sends selected status changes back through controlled workflows.

How to build a SailPoint integration in Martini

Objective

Establish product-specific SailPoint API configuration without treating Identity Security Cloud and IdentityIQ as interchangeable.

Instructions in Martini

  • Store tenant URLs, IdentityIQ endpoints, OAuth credentials, scopes, and service-account settings as protected environment configuration.
  • Use the documented Identity Security Cloud OAuth 2.0 flow or the deployed IdentityIQ authentication model.
  • Keep development, test, and production settings separate.

Objective

Select an event, API request, or schedule that matches the required integration latency and SailPoint event coverage.

Instructions in Martini

  • Use a Martini API or webhook-triggered workflow for supported SailPoint event notifications.
  • Use a scheduled workflow for reconciliation, certification extraction, or unsupported event coverage.
  • Use an inbound API when another application submits an identity or access request.

Objective

Obtain the authoritative SailPoint object and account for pagination, current state, and asynchronous processing.

Instructions in Martini

  • Retrieve the referenced Identity, Account, Source, Entitlement, Role, Access Profile, or certification resource.
  • Follow the endpoint-specific pagination model for collection responses.
  • Capture task or operation identifiers when SailPoint returns a long-running operation.

Objective

Coordinate SailPoint calls, target-system calls, state management, and business outcomes in a maintainable Martini workflow.

Instructions in Martini

  • Separate product-specific Identity Security Cloud and IdentityIQ API configurations where behavior differs.
  • Use correlation keys and checkpoints for retries and multi-step processing.
  • Route transient failures, validation failures, authorization failures, and business-rule rejections separately.

Objective

Convert SailPoint payloads into canonical and target-specific structures while preserving identifiers needed for reconciliation.

Instructions in Martini

  • Map stable identity, account, source, entitlement, role, and request identifiers.
  • Normalize lifecycle states, ownership values, dates, and status enumerations.
  • Validate required attributes before writing to a target system.

Objective

Apply authorization, correlation, approval, and remediation rules before updating SailPoint or a connected application.

Instructions in Martini

  • Prevent duplicate provisioning and repeated access-request submissions.
  • Write approved changes to the target through its supported API or endpoint.
  • Record the SailPoint identifier, target identifier, workflow execution, and business outcome.

Common SailPoint data objects used in integrations

ObjectTypical UseCommon target systemsMartini handling
IdentitiesRepresent people or other governed subjects and their lifecycle attributes.Workday, Oracle HCM Cloud, Microsoft Entra ID, Active Directory, ServiceNowMartini correlates stable identity identifiers, maps attributes and lifecycle states, validates required fields, and synchronizes supported changes through SailPoint APIs.
AccountsRepresent accounts that provide an identity access to connected applications or sources.Active Directory, Microsoft Entra ID, Salesforce, SAP S/4HANA, ServiceNowMartini retrieves account state, normalizes source-native identifiers, applies reconciliation rules, and avoids duplicate updates through idempotent workflows.
SourcesRepresent connected systems from which accounts, entitlements, and identity data are aggregated or provisioned.Active Directory, Microsoft Entra ID, Salesforce, SAP S/4HANAMartini uses source identifiers and configuration metadata to route synchronization and distinguish product-specific source behavior.
EntitlementsRepresent assignable access rights, permissions, groups, or other access items.Microsoft Entra ID, Active Directory, Salesforce, SAP S/4HANA, JiraMartini maps entitlement identifiers and ownership attributes, validates requested access, and sends approved changes or exceptions to target workflows.
RolesGroup business or IT access definitions for role-based governance and requests.ServiceNow, Salesforce, SAP S/4HANA, internal access portalsMartini validates role requests, transforms role metadata, invokes SailPoint access APIs, and monitors asynchronous processing where required.
Access ProfilesGroup entitlements that can be requested or assigned together.ServiceNow, internal access portals, audit platformsMartini exposes controlled request APIs, maps access-profile identifiers, applies authorization rules, and records request and fulfillment outcomes.

Authentication and security considerations

OAuth 2.0 for Identity Security Cloud

Identity Security Cloud integrations use tenant-specific OAuth 2.0 configuration, client credentials, scopes, and bearer access tokens. Martini should store client secrets, token endpoints, API base URLs, and scopes in protected environment configuration.

IdentityIQ authorization

IdentityIQ authentication depends on the deployed security model, service accounts, permissions, and version. Confirm the exact configuration rather than applying Identity Security Cloud assumptions.

Least privilege

  • Use dedicated SailPoint clients or service accounts for each integration boundary.
  • Grant only the scopes and permissions required for the workflow.
  • Keep credentials out of payloads, mappings, and source code.

Operational considerations for SailPoint integrations

Rate limits and pagination

Large identity, account, entitlement, and certification synchronizations should use documented pagination, bounded concurrency, incremental filters where available, and backoff for HTTP 429 or transient responses.

Idempotency and event ordering

Notifications may be duplicated, delayed, or received out of order. Validate each event, retrieve current SailPoint state, and use stable identifiers and correlation keys before creating or updating target objects.

Long-running operations

Aggregation, provisioning, and access-processing actions may return an operation or task identifier instead of immediate completion. Persist the identifier and poll status through a delayed or scheduled workflow.

Product and schema differences

Keep Identity Security Cloud and IdentityIQ endpoints, authentication, mappings, and supported operations distinct. Protect transformations against missing attributes, new optional properties, changed enum values, and deprecated API versions.

Auditability and testing

Record correlation IDs, SailPoint object identifiers, HTTP outcomes, retry counts, workflow status, and business results. Test lifecycle, access-request, certification, pagination, authorization, and duplicate-event scenarios before production deployment.

Why use Martini instead of scripts or point-to-point integrations?

Centralized orchestration

Martini coordinates SailPoint API calls, event intake, target-system updates, validation, asynchronous polling, and business rules in workflows rather than scattering logic across scripts.

Reusable integration assets

Teams can expose controlled APIs, reuse mappings and services, and keep Identity Security Cloud and IdentityIQ-specific configuration separate while sharing appropriate orchestration patterns.

Reliable operations

Martini provides structured handling for pagination, checkpoints, retries, idempotency, logging, and environment-specific secrets. This is useful for identity lifecycle, access governance, and reconciliation processes that must be auditable and recoverable.

Flexible connectivity

When a dedicated SailPoint connector is not required, Martini can consume documented REST APIs, receive selected callbacks, process supported legacy services, and connect to approved databases or files without making unsupported mechanisms the default.

Frequently asked questions

How can SailPoint be integrated with enterprise systems?

SailPoint Identity Security Cloud is primarily integrated through tenant-specific REST APIs secured with OAuth 2.0. It also supports selected event triggers and HTTP-based callbacks, while some aggregation, provisioning, and administrative operations may be asynchronous. IdentityIQ provides REST capabilities that depend on its version and deployment configuration, with possible legacy web services or deployment-specific database access.

Can Martini integrate with SailPoint?

Yes. Martini can consume SailPoint REST APIs, authenticate to Identity Security Cloud with OAuth 2.0, receive selected event notifications through an exposed endpoint, orchestrate workflows, map SailPoint objects, and expose APIs that abstract SailPoint operations. IdentityIQ integrations require product- and deployment-specific configuration.

Do I need a connector to integrate SailPoint with Martini?

No. A dedicated SailPoint connector is not required. Martini can use SailPoint's confirmed native REST APIs, OAuth 2.0 authentication, selected event callbacks, and product-specific web-service or file mechanisms where they are available and documented.

Is there any extra Lonti cost to integrate SailPoint with Martini?

Lonti does not charge an additional per-connector or per-vendor fee to integrate SailPoint with Martini. Integrations are subject to the provisioned capacity of the Martini environment. Separate costs may apply from SailPoint, infrastructure, or other third-party systems depending on subscriptions, usage, and deployment model.

Which SailPoint integration methods should new implementations use?

Use the documented REST APIs for Identity Security Cloud and the supported REST capabilities of the deployed IdentityIQ version. OAuth 2.0 is the primary Identity Security Cloud authentication model. Selected event triggers can support near-real-time flows, while scheduled REST synchronization is appropriate where event coverage is unavailable.

Can SailPoint initiate a Martini workflow through events or callbacks?

Identity Security Cloud supports event triggers and HTTP-based callback patterns for selected events. Martini can expose a secured endpoint, validate the notification, retrieve the current SailPoint resource, and process it. Event coverage is not universal, so unsupported scenarios should use scheduled polling or incremental synchronization.

How does Martini synchronize SailPoint data and handle mapping?

Martini can page through SailPoint collections, correlate stable identifiers, transform Identities, Accounts, Sources, Entitlements, Roles, and Access Profiles into canonical models, and write them to target applications. Workflows can use incremental filters where available, checkpoints, deterministic keys, and explicit validation to support repeatable synchronization.

How does Martini handle SailPoint errors, retries, and duplicate operations?

Martini workflows can distinguish transient API failures from authorization, validation, and business-rule errors, then apply bounded retries with backoff. Idempotency keys based on SailPoint identity, account, request, or certification identifiers help prevent duplicate provisioning and repeated remediation. Long-running operations can be tracked by operation identifiers and polled until completion.

Related Martini documentation

APIs

Events

Workflows

Security

Operations

Plan your SailPoint integration with Martini

Use Martini to connect SailPoint identity governance processes with workforce, directory, application, service management, and audit systems through maintainable APIs and workflows.

EXPLORE MARTINI
BOOK A DEMO