> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/automation.md). # Customize and automate Attach a Groovy script to an OpenIAM extension point, put work on a schedule, and find the contract and the shipped example for each. ## What this is, and when you need it Almost everything OpenIAM does that is specific to your organization is a **Groovy script attached to an extension point** or a **batch task on a schedule**. There is no other customization layer in the administration surface: no rules designer for attribute calculation, no plug-in registry, no expression language beyond Groovy. This section is for the administrator who has to select the right extension point, attach a script to it, test it against a bounded object, put it on a schedule, promote it and roll it back. Every extension point is attached in one of exactly two ways — a system property holding a script reference, which is global to the installation, or a column on the object being configured, which is per-object — and knowing which of the two you are looking at is usually the whole diagnosis when a script is not running. ## Start here 1. [Create a Groovy script](/administration-guide/automation/manage-groovy-scripts.md) — versioning, compiling, testing and rolling back one script, whatever it is attached to. 2. [Create a batch task](/administration-guide/automation/batch-tasks.md) — the other half of the section: running something on a schedule, and finding out what is already running. 3. [Groovy script reference](/administration-guide/reference/groovy-script-reference.md) — where a script actually lives, every column that can hold a reference to one, and the sandbox allow-list. Read [Change configuration safely](/administration-guide/start/change-safely.md) once before your first change. A script attached by a system property runs for the whole installation, so a syntax error in one breaks that operation everywhere, not on one managed system. ## Choose your outcome | I want to… | Go to | | ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Create, version, compile, import, export, promote or roll back a script | [Create a Groovy script](/administration-guide/automation/manage-groovy-scripts.md) | | Change what a feed asserts about a user | [Edit a synchronization transformation script](/administration-guide/automation/synchronization-scripts.md) | | Know exactly what a synchronization transform, validation or attributes script may return | [Synchronization script contracts](/administration-guide/reference/synchronization-script-contracts.md) | | Run something on a schedule, or find out what is already running | [Create a batch task](/administration-guide/automation/batch-tasks.md) | | Put an existing synchronization or reconciliation on a cron schedule | [Run a synchronization on a schedule](/administration-guide/automation/batch-tasks/schedule-a-synchronization.md) | | Every enabled batch task has stopped running at once | [Restart batch tasks that have all stopped](/administration-guide/automation/batch-tasks/diagnose-stalled-batch-tasks.md) | | Calculate one target attribute | [Build a policy map](/administration-guide/lifecycle/policy-map.md) | | Wrap a whole provisioning operation, before or after it runs | [Attach a provisioning processor](/administration-guide/lifecycle/provisioning-processors.md) | | Write a reconciliation population, query, match or command script | [Reconciliation scripts](/administration-guide/lifecycle/reconciliation-scripts.md) | | Validate or shape a field on the user form in Groovy | [Build a page template](/administration-guide/identities/page-templates-and-custom-fields.md) | | Resolve approvers or send workflow notifications from a script | [Approval flows](/administration-guide/requests/approval-flows.md) | | Find out where a script is stored, which columns reference one, and which packages the sandbox allows | [Groovy script reference](/administration-guide/reference/groovy-script-reference.md) | | Start from a working example for any extension point | [Shipped Groovy scripts](/administration-guide/reference/shipped-groovy-scripts.md) | | Look up a `Groovy`-typed system property and the script it ships with | [System property reference](/administration-guide/reference/system-properties.md) | | Look up a shipped batch task's cron expression and whether it ships enabled | [Shipped batch tasks](/administration-guide/reference/shipped-batch-tasks.md) | ## What this section does not own Authoring against the Java APIs — the classes a script calls, the compiled-extension build, the test harness, the REST API — is the **Developer Guide**. This guide gives the Groovy contract for each supported administrative extension point and one working example of each; it does not document OpenIAM as an API. Two extension points are not Groovy at all, and are worth naming so you do not go looking for a script. A batch task can run a named service method instead of a script — see [Create a batch task](/administration-guide/automation/batch-tasks.md). An approval flow's shape is a shipped BPMN 2.0 process definition, whose service tasks are compiled rather than scripted — see [Approval flows](/administration-guide/requests/approval-flows.md) and [Shipped approval workflows](/administration-guide/reference/shipped-workflows.md). The twelve handler columns on a managed system used by the Groovy Script connector are the **Connector Configuration Guide**'s. They hold script paths rather than script ids, which is why **Show References** in the Groovy Manager reports such a script as unreferenced — see [Groovy script reference](/administration-guide/reference/groovy-script-reference.md) before you delete anything on the strength of an empty reference list. *Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/automation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.