Authentication to Saviynt API is typically done using a service account in Saviynt that should have read/write access to the application. This service account username and password need to be provided for authenticating into Saviynt before any APIs can be executed.
However, the best practice guide for managing Saviynt API service accounts recommends following a standard naming convention across all Saviynt API user identities. It also suggests implementing a least privilege approach by creating a custom SAV role that includes only the necessary web service permissions.
If possible, it’s recommended to use a Refresh token to generate an access token so that the static service account userid and password do not need to be stored in the application making API calls.
So, in your case, both options could work, but using a service account with an appropriate SAV role might provide more security and flexibility. This is because service accounts are designed to represent machine users, such as software or business processes, that require authenticated access to privileged resources.
Please let me know if further info is needed on this.
