This guide describes how imper.ai integrates with SailPoint to pull the identity data needed to enroll new employees - their work email, personal email, and start date.

---

Authentication

imper.ai authenticates to the SailPoint Identity Security Cloud (ISC) APIs using the OAuth 2.0 Client Credentials grant.

To enable this, create a dedicated API client (client ID and secret) in SailPoint and share the credentials with imper.ai.

Prerequisites

• You have Admin access to your SailPoint Identity Security Cloud tenant.
• You can reach Admin > Global > Security Settings > API Management.

Step 1: Open API Management

1. Log in to your SailPoint Identity Security Cloud tenant as an administrator.

2. Go to Admin > Global > Security Settings.

3. Select the API Management tab.

Step 2: Create a New API Client

1. Select Create API Client to open the New API Client window.

2. Enter a meaningful Description, for example imper.ai integration.

3. Choose the Client Credentials OAuth 2.0 grant type.

Step 3: Select Scopes

Using the checkboxes, select only the scope imper.ai requires (following the principle of least privilege):

• sp:search:read

NOTE

SailPoint's granular scope support for the search API is still rolling out, so sp:search:read may not return data on every tenant. If it does not, use the broader sp:scopes:all scope, or assign the API client a Report Admin user level instead.

Step 4: Generate and Save the Credentials

1. Select Create to generate the credentials.

2. Copy the client ID and the client secret somewhere safe.

WARNING

Do not close the window before copying the client secret - it cannot be viewed or changed later. If it is lost, you must create a new API client.

Step 5: Share the Credentials with imper.ai

Securely provide the client ID and client secret to imper.ai. imper.ai uses them to obtain an access token and call the endpoints below.

---

Endpoint

imper.ai uses a single SailPoint endpoint:

Endpoint	Purpose	Required scope
POST /search	Look up an identity by email and retrieve its attributes (work email, personal email, and start date) in a single call.	sp:search:read