# Integrating SailPoint with CircleCI

Use the CircleCI connector to discover non-human identities through CircleCI API v2. The connector uses the organization ID that you configure as a scope anchor, and it aggregates the following resources into the **CircleCI NHI Graph** dataset:

- Checkout, SSH, and deploy keys
- OIDC custom claims

The connector is a read-only NHI source. It does not create organization resources, aggregate users or groups, provision access, or store secret values.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

| Feature | Description |
| --- | --- |
| Test connection | Validates the Personal API Token, organization ID, and access to at least one configured project. |
| Dataset aggregation | Aggregates CircleCI configuration and activity metadata into the `circleci:nhi` dataset. |

### Non-Human Identity Discovery

- Aggregate CircleCI checkout, SSH, and deploy keys and OIDC custom claims

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Supported Version

The connector supports CircleCI Cloud API v2. The default API base URL is `https://circleci.com/api/v2`.

For CircleCI Server deployments that expose the same API v2 endpoints, set **CircleCI API Base URL** to your server URL.

## Prerequisites

### Preparing CircleCI

Complete these tasks before you configure the CircleCI source.

1. Sign in to CircleCI with an account that your organization approves for the integration. SailPoint recommends a dedicated automation or machine user. Do not use a personal employee token.
2. Go to **User Settings** \> **Personal API Tokens**, or the equivalent page in your tenant, and create a **Personal API Token**. The connector sends this token in the `Circle-Token` header.
3. Copy the token immediately and store it in your secrets tooling. You enter this value in **Personal API Token** when you configure the source, and SailPoint stores the value encrypted.
4. Grant the token read access to the target organization, including its OIDC custom claims, and to each project that you list in **Project Slugs**.
5. Copy the organization UUID from **Organization Settings** \> **Overview**.
6. Collect each project slug in `vcs/org/repo` format, such as `gh/acme/orders`.

> [!IMPORTANT]
>
> CircleCI API v2 does not support project tokens. It also provides no organization-wide project-list endpoint, so you must supply the project slugs.