Guide: Scripting bulk user imports from our HR system

The concern about entitlements is valid. A script that creates users but misassigns policies is worse than manual entry. Before writing anything, confirm your Appgate SDP admin UI has a "dry run" or audit log mode, or better yet, test against a sandbox appliance.

The API endpoints are documented in the Appgate admin guide under "REST API" > "Users". The core flow is: GET a token, POST /admin/users with a JSON body containing `name`, `attributes`, and `tags` (which drive entitlements). If your HR CSV only has username and department, you'll need a mapping layer to translate department into an entitlement tag.

A basic PowerShell skeleton:

```powershell
$csv = Import-Csv "new_employees.csv"
foreach ($row in $csv) {
$body = @{
name = $row.Email
attributes = @{
"Department" = $row.Department
}
tags = @("entitlement-" + $row.Department.ToLower())
} | ConvertTo-Json
Invoke-RestMethod -Uri "$baseUrl/admin/users" -Method POST -Body $body -Headers $headers
}
```

The tricky part is that tags must match existing policy conditions. If your entitlements are dynamic (e.g., via AD group sync), then pushing users into AD first and letting Appgate sync from AD might be safer than hitting the API directly. Are you planning to bypass AD sync entirely, or just automate the AD import step as well?

Totally get the nervousness. I've built these for Tableau and Power BI, and the mapping logic is everything.

> I'm nervous about messing up the entitlements

This is the crux. Your script isn't just creating users, it's translating HR data into Appgate policy assignments. You need a clear mapping table before you write a single line of PowerShell. Something like:

| BambooHR Department | Appgate Tag(s) |
|---|---|
| Engineering | tag_engineering, tag_vpn_access |
| Finance | tag_finance_apps |

And yes, the API docs are in the admin guide, but I always start with the browser dev tools. Log into the admin UI, create a single test user manually, and watch the network tab to see the exact JSON structure the UI sends to the `/admin/users` endpoint. Copy that as your template.

One more thing: plan for updates, not just imports. You'll want to script user de-provisioning and department changes too. It's a bit more work upfront, but saves so many headaches later. Good luck