This guide describes how imper.ai integrates with SailPoint to pull identity data used for employee and non-employee (vendor/contractor) verification questions.

---

Authentication

imper.ai authenticates to the SailPoint Identity Security Cloud (ISC) APIs using the OAuth 2.0 Client Credentials grant.

To enable this, create a dedicated API client (client ID and secret) in SailPoint and share the credentials with imper.ai.

Prerequisites

• You have Admin access to your SailPoint Identity Security Cloud tenant.
• You can reach Admin > Global > Security Settings > API Management.

Step 1: Open API Management

1. Log in to your SailPoint Identity Security Cloud tenant as an administrator.

2. Go to Admin > Global > Security Settings.

3. Select the API Management tab.

Step 2: Create a New API Client

1. Select Create API Client to open the New API Client window.

2. Enter a meaningful Description, for example imper.ai integration.

3. Choose the Client Credentials OAuth 2.0 grant type.

Step 3: Select Scopes

Using the checkboxes, select only the scopes imper.ai requires (following the principle of least privilege):

• sp:search:read
• idn:nelm:read

NOTE

See Endpoints below for which scope each endpoint requires.

Step 4: Generate and Save the Credentials

1. Select Create to generate the credentials.

2. Copy the client ID and the client secret somewhere safe.

WARNING

Do not close the window before copying the client secret - it cannot be viewed or changed later. If it is lost, you must create a new API client.

Step 5: Share the Credentials with imper.ai

Securely provide the client ID and client secret to imper.ai. imper.ai uses them to obtain an access token and call the endpoints below.

---

Endpoints

imper.ai uses the following SailPoint endpoints:

Endpoint	Purpose	Required scope
POST /search	Look up an identity by email to retrieve all identity data in a single call (a denormalized view including attributes, manager, and more).	sp:search:read
GET /non-employee-records	List and fetch non-employee (vendor/contractor) records.	idn:nelm:read

---

Fields

POST /search

Field	Type	Description	Mandatory
manager.name	string	Direct manager's display name.	Yes
employeeNumber	string	Worker ID / employee number.	Yes
attributes.startDate	date	Employment start date.	Yes
attributes.title	string	Job title.	No - only available if your organization maps this from your HR source.
attributes.department	string	Department name.	No - only available if your organization maps this from your HR source.

GET /non-employee-records

Field	Type	Description	Mandatory
Sponsor / manager relationship	string	Sponsor at the company.	Yes
Contract end date	date	When the contract ends.	Yes
Vendor company / source name	string	Contracting vendor or company.	Yes

---

Verification Questions

Using the fields above, imper.ai asks your employees the following verification questions.

Existing questions

• WHO_IS_YOUR_DIRECT_MANAGER - "Who is your direct manager? Please provide the full name."
• WORKER_ID - "What is your worker ID?"
• HIRE_DATE - "When did you start working with the company? (month and year only)."
• JOB_TITLE - "What is your job title? (e.g. Trainer)"
• DEPARTMENT - "What department are you in? (e.g. Marketing)"

Potential new questions (vendor/contractor-specific)

• WHO_IS_YOUR_SPONSOR - "Who is your sponsor at the company? Please provide the full name."
• CONTRACT_END_DATE - "When does your current contract end? (month and year only)."
• VENDOR_COMPANY - "What vendor or company are you contracted through?"

---

Additional Custom Data

SailPoint's identity attributes map is dynamic - each organization configures which fields are synced from their HR source into their Identity Profile. Beyond the standard fields listed above, you may have additional custom attributes that could be useful for verification questions.

NOTE

Share your Identity Profile attribute list with imper.ai so we can identify any additional fields of interest for verification.