Is SailPoint agent-ready?

SailPoint scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.

Does SailPoint publish an OpenAPI spec?

No published OpenAPI specification was found when SailPoint was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.

What is SailPoint's Headless Index score?

SailPoint scores 74/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Auth & Identity

SailPoint

Headless Index

74/100

JAIRF

N/A

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

SailPoint earns Band B in the Auth & Identity category of The Headless Index, with a thesis-fit score of 74/100. Its strongest dimension is API-first design intent (18/20); its weakest scored dimension is MCP and agent posture (6/20). No public OpenAPI specification was found when SailPoint was scored, which limits how far an agent can go without human integration work.

Editorial verdict

SailPoint is solidly built for programmatic consumption. The Headless Index thesis-fit score of 74/100 lands it in the upper-middle of the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier ship most of the primitives agents need, with one or two surfaces still leaning on documentation rather than discovery, and the rest of this verdict explains where SailPoint lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Few vendors in this category run API governance this openly. Specs live in a public repo (github.com/sailpoint-oss/api-specs) versioned as v3, beta, v2024, v2025 and v2026; a Spectral ruleset lints them; and the published api-guidelines state the rules. The TypeScript, Python and Go SDKs are generated from those specs rather than written beside them. An agent can drive this product across most practical workflows, with a handful of edges where documentation reading still beats schema discovery. On headless operability: The CLI is real and maintained (github.com/sailpoint-oss/sailpoint-cli, Go, 46 stars), and connectors are code rather than configuration through @sailpoint/connector-sdk. Config-as-code stops short of infrastructure tooling: the Terraform registry returns nothing for SailPoint, so tenant configuration, transforms and lifecycle states are scripted against the API one call at a time, or clicked in Identity Security Cloud.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: Identity governance is exactly the domain where an agent needs guardrails, and SailPoint publishes none. No mcp repository sits under the org (github.com/sailpoint-oss lists none), the public registry has no entry, and developer.sailpoint.com has no agent section. The open spec repo means someone will generate a server; it will not be SailPoint's.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Event triggers are named, enumerable and typed: idn:identity-attributes-changed, idn:access-request-post-approval, idn:source-created and idn:campaign-ended among roughly twenty published ids, each listable through the triggers endpoint with filter syntax (id eq "idn:access-request-post-approval"). Two invocation modes exist, fire-and-forget and request-response, the latter letting an agent veto an access request before it completes. Signing detail is the thinnest part. Net assessment: SailPoint can be operated by agents for the majority of practical workflows. The closest thing to a gap is MCP posture^[3], which integrators should sanity-check against their own use case before committing. Strong fit for agent-driven use cases.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent18/20

scored

Few vendors in this category run API governance this openly. Specs live in a public repo (github.com/sailpoint-oss/api-specs) versioned as v3, beta, v2024, v2025 and v2026; a Spectral ruleset lints them; and the published api-guidelines state the rules. The TypeScript, Python and Go SDKs are generated from those specs rather than written beside them.

signals (6)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPI specNot found across 0 probe paths
−GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
+SDKs maintained10 (go, java, javascript, python, typescript); top by stars: sailpoint-oss/api-specs (18 stars)
+SDK recency6 of 10 SDK repos pushed within 30 days (most recent SDK commit: 2026-08-19)
·npm weekly downloads666 across published packages; top: @sailpoint/connector-sdk @ 638/week

cite (1)

ai_review_browser.auth@2026-08-19

Headless operation14/20

scored

The CLI is real and maintained (github.com/sailpoint-oss/sailpoint-cli, Go, 46 stars), and connectors are code rather than configuration through @sailpoint/connector-sdk. Config-as-code stops short of infrastructure tooling: the Terraform registry returns nothing for SailPoint, so tenant configuration, transforms and lifecycle states are scripted against the API one call at a time, or clicked in Identity Security Cloud.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
−API operations exposedNo OpenAPI spec; operations count unknown
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

ai_review_browser.topics_found@2026-08-19

MCP & agent posture6/20

scored

Identity governance is exactly the domain where an agent needs guardrails, and SailPoint publishes none. No mcp repository sits under the org (github.com/sailpoint-oss lists none), the public registry has no entry, and developer.sailpoint.com has no agent section. The open spec repo means someone will generate a server; it will not be SailPoint's.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
−Official MCP serverNone found in vendor's GitHub org or the official MCP registry
−Community MCP serversNone found
+Agent-friendly SDKs6 TS/JS SDKs available; top: api-linter

cite (1)

ai_review_browser.pages_fetched@2026-08-19

Schema observability18/20

scored

Every spec is fetchable raw from GitHub, including a dereferenced set and generated Postman collections (raw.githubusercontent.com/sailpoint-oss/api-specs/main/idn/sailpoint-api.v2025.yaml returns 181KB of YAML). An agent builds a client cold with no prose. The one deduction: the specs are split across idn, iiq and nerm trees, so discovery takes a directory walk first, not a single fetch.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPINot discovered across 0 standard probe paths
−GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)

cite (1)

ai_review_browser.pages_fetched@2026-08-19

Webhooks & events18/20

scored

Event triggers are named, enumerable and typed: idn:identity-attributes-changed, idn:access-request-post-approval, idn:source-created and idn:campaign-ended among roughly twenty published ids, each listable through the triggers endpoint with filter syntax (id eq "idn:access-request-post-approval"). Two invocation modes exist, fire-and-forget and request-response, the latter letting an agent veto an access request before it completes. Signing detail is the thinnest part.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

ai_review_browser.pages_fetched@2026-08-19

JAIRF · 6 dimensions

JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Band rationale:B band: JAIRF=N/A HeadlessIndex=74

04 / Embed

Show SailPoint's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Peers in Auth & Identity

Supabase AuthB

Headless Index 74/100

Permit.ioB

Headless Index 74/100

ZITADELC

Headless Index 72/100

See full Auth & Identity ranking →

FAQ

SailPoint and agent readiness

Is SailPoint agent-ready?: SailPoint scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.
Does SailPoint publish an OpenAPI spec?: No published OpenAPI specification was found when SailPoint was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.
What is SailPoint's Headless Index score?: SailPoint scores 74/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.