@@ -717,14 +717,15 @@ Run a global search across SailPoint indices (identities, entitlements, roles, a
 
 ### `sailpoint_search_aggregate`
 
-Return aggregation buckets for a SailPoint search query (e.g. counts grouped by a field).
+Return the aggregation result (buckets under `aggregations`, plus `hits`) for a SailPoint search query.
 
 #### Input
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
 | `indices` | json | No | Indices to aggregate over \(defaults to \["identities"\]\) |
-| `query` | string | No | Elasticsearch query string |
+| `query` | string | No | Elasticsearch query string to scope the documents before aggregating |
+| `aggregationsDsl` | json | No | Elasticsearch aggregations DSL object defining the buckets/metrics to compute, e.g. \{ "department": \{ "terms": \{ "field": "attributes.department" \} \} \} |
 | `limit` | number | No | Maximum number of aggregation results \(max 250\) |
 | `offset` | number | No | Pagination offset \(0-based\) |
 
 
@@ -46,19 +46,48 @@ export function normalizeApiVersion(value: string | undefined | null): SailPoint
 }
 
 /**
- * Resolves the API + token hosts for a tenant. Accepts either a bare tenant subdomain (`acme`) or a
- * full host/URL (`https://acme.api.identitynow.com`, `acme.api.identitynow.com`), stripping any
- * protocol, path, or version segment the caller may have included.
+ * Allowed SailPoint API host suffixes. A user-supplied full host must end with one of these; this
+ * prevents SSRF and PAT-secret disclosure by ensuring the client-credentials request (which carries
+ * `client_secret`) can only ever be sent to a SailPoint tenant host, never an arbitrary destination.
+ */
+const ALLOWED_HOST_SUFFIXES = ['.api.identitynow.com', '.api.identitynowgov.com'] as const
+
+/**
+ * Resolves the API + token hosts for a tenant. Accepts either a bare tenant subdomain (`acme` →
+ * `acme.api.identitynow.com`) or a full SailPoint host/URL (`https://acme.api.identitynow.com`),
+ * stripping any protocol, path, or version segment. Throws when the resolved host is not a SailPoint
+ * identitynow.com host - the credentials must never be posted to an attacker-controlled or internal
+ * host.
  */
 export function resolveSailPointHosts(
   tenant: string,
   apiVersion: SailPointApiVersion
 ): SailPointHosts {
   let host = tenant.trim().replace(/^https?:\/\//i, '')
-  host = host.replace(/[/?#].*$/, '').replace(/\.+$/, '')
-  if (!host.includes('.')) {
+  host = host
+    .replace(/[/?#].*$/, '')
+    .replace(/\.+$/, '')
+    .toLowerCase()
+
+  if (!host) {
+    throw new Error('SailPoint tenant is required')
+  }
+
+  if (host.includes('.')) {
+    const isAllowed =
+      /^[a-z0-9.-]+$/.test(host) && ALLOWED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix))
+    if (!isAllowed) {
+      throw new Error(
+        `SailPoint host "${host}" is not an allowed identitynow.com host. Enter your tenant name (e.g. "acme") or a full *.api.identitynow.com host.`
+      )
+    }
+  } else {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(host)) {
+      throw new Error(`Invalid SailPoint tenant "${tenant}"`)
+    }
     host = `${host}.api.identitynow.com`
   }
+
   return {
     host,
     apiBaseUrl: `https://${host}/${apiVersion}`,
@@ -92,10 +121,12 @@ interface CachedToken {
 }
 
 const TOKEN_EXPIRY_BUFFER_MS = 60_000
+const MAX_FETCH_RETRIES = 4
 const tokenCache = new Map<string, CachedToken>()
 
 function cacheKey(creds: SailPointServerCredentials): string {
-  return `${creds.tenant}:${creds.clientId}:${creds.apiVersion}`
+  const { host } = resolveSailPointHosts(creds.tenant, creds.apiVersion)
+  return `${host}:${creds.clientId}:${creds.apiVersion}`
 }
 
 /** Drops any cached token for these credentials so the next call re-exchanges. */
@@ -112,19 +143,32 @@ export async function getSailPointAccessToken(creds: SailPointServerCredentials)
   }
 
   const { tokenUrl } = resolveSailPointHosts(creds.tenant, creds.apiVersion)
-  const response = await fetch(tokenUrl, {
-    method: 'POST',
-    headers: {
-      Accept: 'application/json',
-      'Content-Type': 'application/x-www-form-urlencoded',
-    },
-    body: new URLSearchParams({
-      grant_type: 'client_credentials',
-      client_id: creds.clientId,
-      client_secret: creds.clientSecret,
-    }).toString(),
-    cache: 'no-store',
-  })
+
+  let attempt = 0
+  let response: Response
+  while (true) {
+    response = await fetch(tokenUrl, {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        'Content-Type': 'application/x-www-form-urlencoded',
+      },
+      body: new URLSearchParams({
+        grant_type: 'client_credentials',
+        client_id: creds.clientId,
+        client_secret: creds.clientSecret,
+      }).toString(),
+      cache: 'no-store',
+    })
+    // The token endpoint shares SailPoint's per-client_id rate limit, so back off on a 429 too.
+    if (response.status === 429 && attempt < MAX_FETCH_RETRIES) {
+      const retryAfterMs = parseRetryAfter(response.headers.get('retry-after'))
+      attempt += 1
+      await sleep(backoffWithJitter(attempt, retryAfterMs))
+      continue
+    }
+    break
+  }
 
   const data: unknown = await response.json().catch(() => null)
   if (!response.ok) {
@@ -134,7 +178,8 @@ export async function getSailPointAccessToken(creds: SailPointServerCredentials)
     throw new Error('SailPoint authentication did not return an access token')
   }
 
-  const expiresInSec = typeof data.expires_in === 'number' ? data.expires_in : 3600
+  const parsedExpiry = Number(data.expires_in)
+  const expiresInSec = Number.isFinite(parsedExpiry) && parsedExpiry > 0 ? parsedExpiry : 3600
   tokenCache.set(key, {
     token: data.access_token,
     expiresAt: Date.now() + Math.max(expiresInSec * 1000 - TOKEN_EXPIRY_BUFFER_MS, 0),
@@ -163,7 +208,7 @@ export async function sailpointFetch(
   buildRequest: (token: string, hosts: SailPointHosts) => { url: string; init: RequestInit },
   options: { maxRetries?: number } = {}
 ): Promise<SailPointFetchResult> {
-  const maxRetries = options.maxRetries ?? 4
+  const maxRetries = options.maxRetries ?? MAX_FETCH_RETRIES
   const hosts = resolveSailPointHosts(creds.tenant, creds.apiVersion)
   let attempt = 0
   let refreshedOn401 = false
 
@@ -61,7 +61,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     apiVersion: normalizeApiVersion(body.apiVersion),
   }
 
-  const formData = new FormData()
+  let fileBuffer: Buffer | null = null
+  let fileName = 'aggregation.csv'
+  let fileType = 'text/csv'
 
   if (body.file && typeof body.file === 'object') {
     const userFiles = processFilesToUserFiles([body.file as RawFileInput], requestId, logger)
@@ -75,11 +77,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     try {
       const { buffer } = await downloadServableFileFromStorage(userFile, requestId, logger)
-      formData.append(
-        'file',
-        new Blob([new Uint8Array(buffer)], { type: userFile.type || 'text/csv' }),
-        userFile.name || 'aggregation.csv'
-      )
+      fileBuffer = buffer
+      fileName = userFile.name || 'aggregation.csv'
+      fileType = userFile.type || 'text/csv'
     } catch (error) {
       const notReady = docNotReadyResponse(error)
       if (notReady) return notReady
@@ -90,22 +90,36 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     }
   }
 
-  if (body.operation === 'sailpoint_load_accounts' && body.disableOptimization) {
-    formData.append('disableOptimization', 'true')
-  }
-
+  const includeDisableOptimization =
+    body.operation === 'sailpoint_load_accounts' && body.disableOptimization === true
   const loadPath = LOAD_PATHS[body.operation]
 
+  /**
+   * Builds a fresh multipart body for every attempt. A single FormData instance can be a consumed
+   * (non-replayable) stream, so reusing it across the client's 401/429 retries could send the
+   * aggregation without the CSV - rebuild it per request instead.
+   */
+  const buildFormData = (): FormData => {
+    const formData = new FormData()
+    if (fileBuffer) {
+      formData.append('file', new Blob([new Uint8Array(fileBuffer)], { type: fileType }), fileName)
+    }
+    if (includeDisableOptimization) {
+      formData.append('disableOptimization', 'true')
+    }
+    return formData
+  }
+
   try {
     logger.info(`[${requestId}] SailPoint aggregation`, {
       operation: body.operation,
       apiVersion: creds.apiVersion,
-      hasFile: formData.has('file'),
+      hasFile: fileBuffer != null,
     })
 
     const result = await sailpointFetch(creds, (_token, hosts) => ({
       url: `${hosts.apiBaseUrl}/sources/${encodeURIComponent(body.sourceId)}/${loadPath}`,
-      init: { method: 'POST', body: formData },
+      init: { method: 'POST', body: buildFormData() },
     }))
 
     if (!result.ok) {
 
@@ -124,6 +124,34 @@ describe('SailPoint query route', () => {
     expect(data.output.results).toEqual([{ _type: 'identity', id: 'i1' }])
   })
 
+  it('preserves the aggregation object returned by /search/aggregate', async () => {
+    const aggregationResult = {
+      aggregations: { department: { buckets: [{ key: 'Finance', count: 12 }] } },
+      hits: [],
+    }
+    fetchMock
+      .mockResolvedValueOnce(tokenResponse())
+      .mockResolvedValueOnce(jsonResponse(aggregationResult))
+
+    const request = createMockRequest('POST', {
+      ...baseCreds,
+      tenant: 'acme-aggregate',
+      operation: 'sailpoint_search_aggregate',
+      indices: 'identities',
+      query: 'attributes.department:*',
+    })
+
+    const response = await POST(request)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(fetchMock.mock.calls[1]?.[0]).toBe(
+      'https://acme-aggregate.api.identitynow.com/v2025/search/aggregate'
+    )
+    // The full AggregationResult object is preserved under `item`, not dropped as an empty list.
+    expect(data.output).toEqual({ item: aggregationResult })
+  })
+
   it('caches the token across calls with the same credentials', async () => {
     fetchMock
       .mockResolvedValueOnce(tokenResponse())
@@ -204,6 +232,38 @@ describe('SailPoint query route', () => {
     expect(fetchMock).not.toHaveBeenCalled()
   })
 
+  it('rejects a non-SailPoint tenant host without sending credentials (SSRF guard)', async () => {
+    const request = createMockRequest('POST', {
+      ...baseCreds,
+      tenant: 'evil.example.com',
+      operation: 'sailpoint_list_identities',
+    })
+
+    const response = await POST(request)
+    const data = await response.json()
+
+    expect(response.status).toBe(500)
+    expect(fetchMock).not.toHaveBeenCalled()
+    expect(data.error).toContain('not an allowed')
+  })
+
+  it('accepts a full *.api.identitynow.com host', async () => {
+    fetchMock
+      .mockResolvedValueOnce(tokenResponse())
+      .mockResolvedValueOnce(jsonResponse([{ id: 'i1' }]))
+
+    const request = createMockRequest('POST', {
+      ...baseCreds,
+      tenant: 'https://acme.api.identitynow.com',
+      operation: 'sailpoint_list_identities',
+    })
+
+    const response = await POST(request)
+
+    expect(response.status).toBe(200)
+    expect(fetchMock.mock.calls[1]?.[0]).toBe('https://acme.api.identitynow.com/v2025/identities')
+  })
+
   it('propagates a SailPoint error body', async () => {
     fetchMock
       .mockResolvedValueOnce(tokenResponse())
 
@@ -167,7 +167,8 @@ function dispatch(
         query: body.query ? { query: body.query } : undefined,
         sort: toStringList(body.sort),
         searchAfter: toStringList(body.searchAfter),
-        includeNested: body.includeNested,
+        // Only send includeNested when explicitly false; the API already defaults it to true.
+        includeNested: body.includeNested === false ? false : undefined,
       })
       return execute(
         creds,
@@ -195,6 +196,7 @@ function dispatch(
       const searchBody = filterUndefined({
         indices: toStringList(body.indices) ?? ['identities'],
         query: body.query ? { query: body.query } : undefined,
+        aggregationsDsl: body.aggregationsDsl,
       })
       return execute(
         creds,
@@ -203,7 +205,9 @@ function dispatch(
           url: `${h.apiBaseUrl}/search/aggregate${qs({ limit: body.limit, offset: body.offset })}`,
           init: jsonInit(searchBody),
         }),
-        'search'
+        // /search/aggregate returns an AggregationResult object (aggregations + hits), not an
+        // array - route it as an item so the buckets are preserved rather than dropped.
+        'item'
       )
     }
     case 'sailpoint_list_identities':