Skip to content

Integrating SailPoint with AppDirect

AppDirect is a cloud-based commerce and identity platform used to run digital marketplaces. Organizations (companies) on a marketplace manage users, membership roles, groups, and application assignments. The AppDirect connector enables SailPoint to aggregate users for a single AppDirect company and their membership roles for that company. This document provides the instructions required to configure a new direct connection between SailPoint and AppDirect. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The AppDirect connector supports the following:

Account Management

  • Aggregate Users

Entitlement Management

  • Aggregate Membership Roles

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Scope Model

This connector is company-scoped. You provide a Company ID (companyId) in connection settings. Aggregation reads only users and roles for that company:

Marketplace
 └── Company (configured via companyId)
      └── Memberships
           ├── User (Account)
           └── Roles (Entitlements for that company only)

Note

  • Roles live on the company membership, not on the global user roles array (which is typically only ROLE_USER).
  • One SailPoint source = one AppDirect company. To govern multiple companies, create multiple sources (or extend the connector later).

Prerequisites

Before configuring the AppDirect connector, ensure the following requirements are met:

  1. Go to AppDirect sign in and select Monetization Platform (marketplace dashboard). Do not use Advisor Portal, Procurement Platform, or Developer Center for connector setup or testing. Then sign in with a Marketplace Manager account.
  2. Go to Manage > Marketplace > Settings > Integration > API Clients.
  3. Select Create API Client.

  4. Configure the API client as follows:

    • Name: Enter a name for the SailPoint integration.
    • Client Type: Non-interactive application (server-to-server).
    • Protocol: OAuth 2.0.
    • Grant Type: Client Credentials.
    • Allowed Scopes: ROLE_PARTNER (read/write) or ROLE_PARTNER_READ (read-only).

  5. Select Save. AppDirect generates a Consumer Key (Client ID) and Consumer Secret (Client Secret) - copy and securely store both. The secret is shown only once.

  6. Identify your marketplace host (for example, testdemo.byappdirect.com from https://testdemo.byappdirect.com/admin). Use the host without /admin for API and token URLs.
  7. Identify the Company UUID (companyId) for the company you want to aggregate (from the AppDirect UI or GET /api/account/v2/companies).
  8. Record the following values for SailPoint configuration:
    • Base URL
    • Token URL
    • Client ID
    • Client Secret
    • Company ID (companyId)

Token Notes

Note

  • AppDirect uses OAuth 2.0 Client Credentials. Access tokens are short-lived (expires_in). The connector requests a new access token when needed. Client Credentials does not return a refresh token.
  • The connector sends OAuth request parameter: scope=ROLE_PARTNER.
  • Tokens are valid only for the marketplace that issued them.
  • Regenerating the Client Secret invalidates prior credentials for that API client.

Required Permissions

Who Can Generate a Client ID/Secret

Only users with the Marketplace Manager role can create and manage API clients (Manage > Marketplace > Settings > Integration > API Clients).

How Permissions Affect Connector Access

Access is governed by the scopes granted to the API client:

Scope Access
ROLE_PARTNER Read and write marketplace data (recommended if provisioning may be added later)
ROLE_PARTNER_READ Read-only marketplace data (sufficient for aggregation-only)

Client Credentials with ROLE_PARTNER or ROLE_PARTNER_READ provides system-level access and does not act on behalf of an end user. This is the recommended grant type for SailPoint aggregation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.