# Integrating SailPoint with N8N SaaS

This guide describes the requirements and configuration steps to connect SailPoint to N8N Cloud (or another N8N deployment that exposes the standard N8N REST API).

The connector uses the N8N REST API to run test connection, aggregate N8N platform users as accounts, and aggregate N8N team projects as group entitlements for user governance. The connector also uses Dataset 2.0 to aggregate workflows, agents, tools, MCP clients, MCP servers, and stored credentials as machine identities.

The N8N API does not return secret credential values. The connector aggregates credential metadata only.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

| Feature | Description |
| --- | --- |
| Test connection | Validates reachability of the N8N API and the configured API key using a lightweight workflows request. |
| Account aggregation | Aggregates N8N platform users (`GET /api/v1/users`). |
| Entitlement aggregation | Aggregates N8N team projects as group entitlements (`GET /api/v1/projects`). Personal projects are excluded from account membership. |
| Dataset aggregation | Aggregates machine identities using Dataset 2.0: dataset `N8N:workflow-graph` (workflows, agents, tools, MCP clients, MCP servers) and dataset `N8N:credentials` (stored integration credentials). |
| Activate and Deactivate N8N Agents | Activates and deactivates N8N agents. |

### Non-Human Identity Discovery

- Aggregate N8N workflows, agents, tools, MCP clients, and MCP servers
- Aggregate N8N stored integration credentials

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Supported Versions

The connector supports the following N8N versions:

- N8N Cloud, version 2.17.6

> [!NOTE]
>
> Verify compatibility with your tenant. Newer minor releases might work if the REST API remains compatible.

## Prerequisites

- [N8N API key](<#creating-an-api-key>). SailPoint sends the key in the X-N8N-API-KEY header.

### Creating an API Key

SailPoint authenticates to N8N using an **API key** sent as the `X-N8N-API-KEY` header.

1. Sign in to **N8N**.
2. Go to **Settings** \> **N8N API**.
3. Select **Create an API key**.
4. Choose a **Label** and set an **Expiration** time for the key.
5. (Optional) If your organization uses an enterprise plan that scopes API keys, include read scopes required for workflows, credentials, users, and projects - for example `workflow:read`, `workflow:list`, and credential read access as defined by your N8N deployment.
6. Copy the API key and store it securely. You will paste it into the SailPoint source as **API Key**.

Grant the key only the permissions your organization requires for discovery and governance. Secret credential values are never returned by the N8N API; the connector aggregates credential metadata only.

For UI-specific steps and screenshots, refer to [N8N API authentication documentation](<https://docs.n8n.io/api/authentication/>) or your internal runbooks.