REST API endpoints available for automating SDP User Management

In Spirion Sensitive Data Platform (SDP), user and role management is governed primarily by the IdentityAuthority (Svc-IdentityAuthority) and UserProfile (Svc-UserProfile) backend microservices.

Depending on whether you are connecting directly to the internal service API or planning against the public REST API suite, the endpoints break down as follows:

1. Authentication & Token Generation

Before calling any User Management endpoints, clients must authenticate against IdentityAuthority using OAuth2 client credentials:

• Token Endpoint: POST /connect/token
• • Payload: grant_type=client_credentials, client_id, client_secret, and appropriate scopes.
  • Returns: Bearer access token used in the Authorization: Bearer <token> header for subsequent calls.

2. Core User & Role Management REST API Specification

The automated RESTful API specification covers full CRUD across four distinct functional areas:

A. User Account Management

• Create User — Provisions a new user account with profile information and email validation.
• Read / Get User — Retrieves user account details
• • For example, GET /api/User/byId/{Id}
• Update User — Updates user contact info, status, or credentials.
• Delete User — Soft-deletes or deactivates the user record.

B. User Role-Based Access Control (User RBAC)

• Create User RBAC — Assigns roles to an existing user.
• Read User RBAC — Retrieves the assigned roles and permission scopes for a specific user.
• Update User RBAC — Modifies role bindings for a user.
• Delete User RBAC — Revokes a specific role assignment from a user.

C. Role Management

• Create Role — Creates a new custom role derived from predefined Base Roles.
• Read Role — Retrieves role definitions and details.
• Update Role — Modifies role naming, description, or activation status.
• Delete Role — Removes or archives a custom role.

D. Role RBAC

• Create Role RBAC — Maps specific platform permissions and module access to a role.
• Read Role RBAC — Inspects the permission set assigned to a role.
• Update Role RBAC — Adjusts granular permissions within an existing role.
• Delete Role RBAC — Removes permission bindings from a role.

3. Bulk & Directory-Based Automation Alternatives

When managing users at scale rather than issuing individual REST calls:

• CSV Ingestion Pipeline: Handled via Svc-UserProfile (which parses and validates batch user payloads) and routes records to Svc-IdentityAuthority for deduplication and persistence.
• Automated Directory Sync: Automated provisioning and deprovisioning can be delegated to scheduled Entra ID (Azure AD) synchronization pipelines using Microsoft Graph API endpoints:
• • /v1.0/users and /transitiveMemberOf

4. Interactive Swagger / OpenAPI Documentation

To inspect the exact request/response schemas, field models, and available endpoints on a given environment:

• INT / Cloud Environment: https://identity-authority.-spirion.com/swagger/index.html
• Local Development: https://localhost:44304/swagger/index.html

Token request payload and Postman setup for IdentityAuthority

To connect to IdentityAuthority (Svc-IdentityAuthority) via Postman, you can generate either a User Token (acting on behalf of an authenticated user via Resource Owner Password credentials) or a Service Token (direct service-to-service communication via Client Credentials).

Option 1: User Token (Resource Owner Password Grant)

This is the standard approach for testing APIs that require user identity and permissions (such as User Management, Results, and Policies).

1. Raw HTTP Request Payload

• Method: POST
• URL: https://identity-authority.<env>-spirion.com/connect/token *(For local development: https://localhost:5500/connect/token)
• Headers: Content-Type: application/x-www-form-urlencoded
• Body (x-www-form-urlencoded):

  grant_type=password&client_id=postman-api&client_secret=secret&scope=api1&username=clientadmin@spirion.com&password=wordpass

  (replace username and password with the portal credentials for the target environment).

2. Postman Authorization Tab Setup

Procedure:

1. In Postman, open your collection or individual request and select the Authorization tab.
2. Select Type: OAuth 2.0.
3. Under Configure New Token, set the following fields:
4. • Token Name: IdentityAuthority User Token
   • Grant Type: Password Credentials
   • Access Token URL: https://identity-authority.<env>-spirion.com/connect/token
   • • For example, https://identity-authority.newqa-spirion.com/connect/token or https://localhost:5500/connect/token
   • Client ID: postman-api
   • Client Secret: secret
   • Username: clientadmin@spirion.com (or your admin email)
   • Password: wordpass (or corresponding password)
   • Scope: api1
   • Client Authentication: Send client credentials in body
4. Click Get New Access Token, then select Use Token.

Option 2: Service Token (Client Credentials Grant)

Used when testing backend microservice APIs directly without a user context.

1. Raw HTTP Request Payload

• Method: POST
• URL: https://identity-authority.</env>-spirion.com/connect/token
• Headers: Content-Type: application/x-www-form-urlencoded
• Body (x-www-form-urlencoded):

  grant_type=client_credentials&client_id=<ServiceName>&client_secret=<ServiceSecret>&scope=<ServiceScope>

2. Postman Authorization Tab Setup

Procedure:

1. In Postman, go to the Authorization tab and choose OAuth 2.0.
2. Under Configure New Token, enter:
3. • Grant Type: Client Credentials
   • Access Token URL: https://identity-authority.-spirion.com/connect/token
   • Client ID: Specific service name (for example, SearchControllerService, UserProfileService, or ReportingService)
   • Client Secret: Service secret (retrieved from the deployment secrets / Lens)
   • Scope: Associated service scope (e.g., searchcontroller-api, userprofile-api, or reporting-api)
   • Client Authentication: Send as Basic Auth Header
3. Click Get New Access Token → Use Token.

Sample Token Response

Upon success, IdentityAuthority returns an HTTP 200 OK with the Bearer JWT:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6...",
  "expires_in": 3600,
  "token_type": "Bearer",
  "scope": "api1"
}

Postman will automatically append this to your subsequent requests as:

Authorization: Bearer <access_token>