What is here
- Cloud rules run in the SailPoint cloud with read-only access. Each template produces a
Rule - {type} - {name}.xml file in the format SailPoint asks for.
- Connector rules run on the virtual appliance. You get the script (
.bsh) and a JSON file in the connector rule object model.
- Transforms are JSON for
POST /v3/transforms.
- Rule checker scans a rule you paste for code SailPoint blocks or reviews:
getObjectById(), search(), sleep(), System.out, threads, external calls and hard-coded secrets.
How accurate is it
Rule types, input argument names and return values were read from SailPoint's developer documentation on 2026-10-21. The code bodies are written for this tool, based on SailPoint's own examples where they exist. Test every rule in a sandbox. Cloud rules also need SailPoint's review before deployment, and the checker cannot replace that.
Not generated: the Active Directory before and after operation rules (they wrap a PowerShell script on the IQService) and the SAP rules. They appear as reference cards. The connector rule JSON field names should be checked against the current API reference.
Parameters
Text values are escaped for Java string literals, so quotes and backslashes are safe. Names that become SQL columns or identifiers accept only letters, digits and underscores.