ExamFinch.com My Study

Study guide

9.3 Common SailPoint API Objects and Methods

Practice this exam

SailPoint Certified IdentityIQ Engineer Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: The IdentityIQ Engineer Exam

1.1 Exam Format, Official Blueprint, and Study Strategy

2 Chapter 2: Infrastructure, Installation, and Extended Attributes

2.1 IdentityIQ Infrastructure Components 2.2 Installation Steps and Procedures 2.3 Creating Extended Attributes and the Objects That Support Them

3 Chapter 3: Build, Deployment, Patching, Access, and Email

3.1 Ongoing Build and Deployment 3.2 Installing Patches and Performing Upgrades 3.3 Configuring End-User Access 3.4 Email Server Settings and Email Redirection

4 Chapter 4: Lifecycle Manager Configuration, Provisioning Policies, and Workflows

4.1 Configuring Lifecycle Manager 4.2 Identity Provisioning Policies 4.3 Configuring LCM Workflows

5 Chapter 5: Lifecycle Events, QuickLinks, Batch Requests, and Rapid Setup

5.1 Lifecycle Events and Their Workflows 5.2 QuickLinks and QuickLink Populations 5.3 Configuring and Using Batch Requests 5.4 Rapid Setup in Lifecycle Events and Identity Operations

6 Chapter 6: Certification Campaigns and Certification Rules

6.1 Configuring and Scheduling Certification Campaigns 6.2 The Purpose of Common Certification Rules

7 Chapter 7: Policies and Policy Violations

7.1 Configuring and Leveraging Policies 7.2 Responding to Policy Violations

8 Chapter 8: Reporting, Advanced Analytics, and Auditing

8.1 Executing and Leveraging Reports 8.2 Leveraging Advanced Analytics 8.3 Configuring and Using Auditing

9 Chapter 9: Rules, Rule Libraries, and the SailPoint API

9.1 The Purpose and Use of Rule Libraries 9.2 Rule Input and Output Arguments 9.3 Common SailPoint API Objects and Methods

10 Chapter 10: Workflow Development

10.1 Workflow Variables, Transitions, and Step Conditions 10.2 Workflow Steps That Generate Work Items 10.3 The Different Workflow Step Usages 10.4 Leveraging Sub-Workflows

11 Chapter 11: Email Templates, Branding, and Localization

11.1 Customizing and Using Email Templates 11.2 Branding the SailPoint User Interface 11.3 Localizing the SailPoint UI

12 Chapter 12: Application Definitions, Connector Settings, and Rapid Setup Aggregation

12.1 Configuring Application Definitions 12.2 Configuring Common Connector Settings 12.3 Configuring Rapid Setup Aggregation Settings

13 Chapter 13: Data-Loading Tasks and Application and Connector Rules

13.1 Scheduling Tasks for Data Loading and Processing 13.2 Common Application Rule Types 13.3 Common Connector Rule Types

14 Chapter 14: Debugging with log4j, Syslog, and the IdentityIQ Console

14.1 Configuring and Leveraging log4j 14.2 Configuring and Leveraging Syslog 14.3 Leveraging the IdentityIQ Console for Debugging

15 Chapter 15: Debug Pages and the Administrator Console

15.1 Leveraging the Debug Pages for Debugging 15.2 Leveraging the Administrator Console for Debugging

16 Chapter 16: Role Model and Identity Attribute Mappings

16.1 Default Role Models and Role Types 16.2 Configuring Roles and Role Options 16.3 Configuring Identity Attribute Mappings

17 Chapter 17: Data Objects, Relationships, and Group Types

17.1 Common IdentityIQ Data Objects 17.2 Relationships Between Common Data Object Models 17.3 The Difference Between Group Types

9.3 Common SailPoint API Objects and Methods

Key Takeaways Explain This Topic AI

SailPointContext provides getObjectByName, getObjectById, getObject, search, countObjects, saveObject, removeObject, commitTransaction, decache, runRule, and sendEmailNotification.

context.search with a property list runs a projection query that returns Object[] rows instead of full objects, which is far more efficient for large result sets.

Filter builds criteria (eq, ne, like, in, and, or, isnull), and QueryOptions carries filters, ordering, distinct, and result limits.

Changes made through saveObject are not permanent until commitTransaction is called, and decache frees memory in long loops.

Access changes should go through a ProvisioningPlan (AccountRequest plus AttributeRequest) run by the Provisioner or a workflow, not direct edits to Link objects.

Last updated: September 2026

Common SailPoint API Objects and Methods

Objective 4.7 asks you to know the common SailPoint API objects and methods and how to leverage them . The full API is in the javadocs that ship with every installation, under identityiq_home/doc/javadoc . Exam items focus on a small, high-use set.

SailPointContext: The Gateway

Every rule receives context , a sailpoint.api.SailPointContext :

  • Method Use
  • getObjectByName(Class, name) / getObjectById(Class, id) / getObject(Class, idOrName) Fetch one object
  • getObjects(Class, QueryOptions) Fetch a List (fine for small sets)
  • search(Class, QueryOptions) Stream matches as an Iterator of objects

search(Class, QueryOptions, List props) Projection query : an Iterator of Object[] rows holding only the listed properties

  • countObjects(Class, QueryOptions) Count without loading
  • saveObject(obj) / removeObject(obj) Stage a save or delete
  • commitTransaction() / rollbackTransaction() Make staged changes permanent, or undo them
  • decache() / decache(obj) Clear loaded objects from the Hibernate session to free memory
  • runRule(rule, Map args) Run another rule
  • sendEmailNotification(EmailTemplate, EmailOptions) Send an email from code
  • encrypt(String) / decrypt(String) Use the IdentityIQ keystore
  • Querying With Filter and QueryOptions import sailpoint.object.*;
  • import java.util.*;
  • QueryOptions qo = new QueryOptions();
  • qo.addFilter(Filter.and(
  • Filter.eq("department", "Finance"),
  • Filter.eq("inactive", false)));
  • qo.addOrdering("lastname", true);
  • qo.setResultLimit(500);
  • List props = Arrays.asList(new String[] {"name", "email", "manager.name"});
  • Iterator it = context.search(Identity.class, qo, props);
  • while (it.hasNext()) {
  • Object[] row = (Object[]) it.next();
  • String name = (String) row[0];
  • // ... row[1] is the email, row[2] the manager's name
  • }

Filter static methods include eq , ne , like (with a match mode), in , and , or , not , isnull , notnull , and ignoreCase . Filter.compile("department == \"Finance\"") parses a filter string, the same syntax the Advanced Search "view/edit filter source" link shows.

QueryOptions carries filters plus addOrdering , setDistinct , setResultLimit , and setFirstRow . The documentation's own form examples build a distinct, ordered projection query to fill a drop-down.

Dot notation reaches related objects: manager.name , application.name , identity.department .

Only searchable attributes (extended columns, section 2.3) can be used in database filters. Non-searchable attributes are stored in XML and cannot be queried efficiently.

The Core Object Classes

Class Represents Frequently used methods

Identity An identity cube getName , getDisplayName , getFirstname , getEmail , getManager , getAttribute(name) , setAttribute , getLinks , getAssignedRoles , getDetectedRoles , isInactive , getCapabilities , getWorkgroups

Link An account getNativeIdentity , getApplication , getApplicationName , getAttribute , getIdentity , getDisplayName

Application An application definition getName , getConnector , getAttributeValue , getSchema("account") , isAuthoritative

Bundle A role getName , getType , getRequirements , getPermits , getInheritance , getProfiles

ManagedAttribute An entitlement or account group in the catalog getApplication , getAttribute , getValue , getDisplayName , getOwner , isRequestable

  • ResourceObject Account or group data from a connector during aggregation getIdentity , getAttribute , put
  • Custom A key/value configuration object get(key) , put(key, value) for lookup tables used by rules
  • Changing Access: ProvisioningPlan

Do not edit Link attributes directly to grant access. Describe the change as a ProvisioningPlan and let IdentityIQ provision it, audit it, and keep the identity cube consistent: import sailpoint.object.ProvisioningPlan;

  • import sailpoint.object.ProvisioningPlan.AccountRequest;
  • import sailpoint.object.ProvisioningPlan.AttributeRequest;
  • import sailpoint.api.Provisioner;
  • ProvisioningPlan plan = new ProvisioningPlan();
  • plan.setIdentity(identity);
  • AccountRequest acct = new AccountRequest(AccountRequest.Operation.Modify,
  • "Active Directory", null, link.getNativeIdentity());
  • acct.add(new AttributeRequest("memberOf", ProvisioningPlan.Operation.Add,
  • "CN=Finance,OU=Groups,DC=acme,DC=com"));
  • plan.add(acct);
  • Provisioner p = new Provisioner(context);
  • p.execute(plan);

AccountRequest operations include Create, Modify, Delete, Enable, Disable, Unlock, and Lock. AttributeRequest operations are Add, Remove, and Set. In a workflow, pass the plan to LCM Provisioning or a provisioning subprocess instead, so that approvals and policy checks still apply.

Helper Classes

sailpoint.api.IdentityService – for example, getLinks(identity, application) finds an identity's accounts on one application.

sailpoint.api.ObjectUtil – utilities such as convertIdsToNames(context, Application.class, ids) , used in the documentation's report examples, plus locking helpers for safely updating identities.

sailpoint.tools.Util – null-safe helpers such as isNullOrEmpty , isNotNullOrEmpty , otos (object to string), otob (to boolean), and CSV/list conversions.

Two Everyday Recipes

Lookup tables in a Custom object. Instead of hard-coding a department-to-cost-center map in five rules, store it once: import sailpoint.object.Custom;

  • Custom map = context.getObjectByName(Custom.class, "ACME Cost Centers");
  • String cc = (map != null) ? (String) map.get(department) : null;

Sending an email from code. The documentation's Test Email Sending rule shows the pattern: load an EmailTemplate by name, take a copy with deepCopy(context) , put template arguments in a Map, wrap the recipient and arguments in EmailOptions , then call context.sendEmailNotification(template, options) . With email redirection on (section 3.4), this is a safe way to test templates.

Patterns That Separate Good Code From Outages

Iterate, do not load everything. Use search (ideally a projection) instead of getObjects for large sets.

Commit, then decache, in loops. Call commitTransaction() after saves and decache() every few hundred objects, so the session does not grow until memory runs out.

Never commit inside certain rules unless required. Aggregation, correlation, and customization rules run inside IdentityIQ's own transaction. Return data and let the engine save it.

Handle nulls. Attributes and managers may be missing, so use Util helpers.

Log at debug, not println. The documentation suggests println only for temporary debugging, removed before production. Prefer a named logger (section 14.1).