# Integrating SailPoint with AppDirect

AppDirect is a cloud-based commerce and identity platform used to run digital marketplaces. Organizations (companies) on a marketplace manage users, membership roles, groups, and application assignments. The AppDirect connector enables SailPoint to aggregate users for a single AppDirect company and their membership roles for that company. This document provides the instructions required to configure a new direct connection between SailPoint and AppDirect. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The AppDirect connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Membership Roles

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Scope Model

This connector is **company-scoped**. You provide a **Company ID** (`companyId`) in connection settings. Aggregation reads only users and roles for that company:

```text
Marketplace
 └── Company (configured via companyId)
      └── Memberships
           ├── User (Account)
           └── Roles (Entitlements for that company only)
```

> [!NOTE]
>
> - Roles live on the **company membership**, not on the global user `roles` array (which is typically only `ROLE_USER`).
> - One SailPoint source = one AppDirect company. To govern multiple companies, create multiple sources (or extend the connector later).

## Prerequisites

Before configuring the AppDirect connector, ensure the following requirements are met:

1. Go to [AppDirect sign in](<https://www.appdirect.com/signin>) and select **Monetization Platform** (marketplace dashboard). Do **not** use Advisor Portal, Procurement Platform, or Developer Center for connector setup or testing. Then sign in with a **Marketplace Manager** account.
2. Go to **Manage \> Marketplace \> Settings \> Integration \> API Clients**.
3. Select **Create API Client**.
4. Configure the API client as follows:

   - **Name:** Enter a name for the SailPoint integration.
   - **Client Type:** **Non-interactive application** (server-to-server).
   - **Protocol:** **OAuth 2.0**.
   - **Grant Type:** **Client Credentials**.
   - **Allowed Scopes:** **ROLE\_PARTNER** (read/write) or **ROLE\_PARTNER\_READ** (read-only).
5. Select **Save**. AppDirect generates a **Consumer Key (Client ID)** and **Consumer Secret (Client Secret)** - copy and securely store both. The secret is shown only once.
6. Identify your marketplace host (for example, `testdemo.byappdirect.com` from `https://testdemo.byappdirect.com/admin`). Use the host without `/admin` for API and token URLs.
7. Identify the **Company UUID** (`companyId`) for the company you want to aggregate (from the AppDirect UI or `GET /api/account/v2/companies`).
8. Record the following values for SailPoint configuration:

   - **Base URL**
   - **Token URL**
   - **Client ID**
   - **Client Secret**
   - **Company ID** (`companyId`)

### Token Notes

> [!NOTE]
>
> - AppDirect uses **OAuth 2.0 Client Credentials**. Access tokens are short-lived (`expires_in`). The connector requests a new access token when needed. Client Credentials does **not** return a refresh token.
> - The connector sends OAuth request parameter: `scope=ROLE_PARTNER`.
> - Tokens are valid only for the marketplace that issued them.
> - Regenerating the Client Secret invalidates prior credentials for that API client.

## Required Permissions

### Who Can Generate a Client ID/Secret

Only users with the **Marketplace Manager** role can create and manage API clients (**Manage \> Marketplace \> Settings \> Integration \> API Clients**).

### How Permissions Affect Connector Access

Access is governed by the scopes granted to the API client:

| Scope | Access |
| --- | --- |
| `ROLE_PARTNER` | Read and write marketplace data (recommended if provisioning may be added later) |
| `ROLE_PARTNER_READ` | Read-only marketplace data (sufficient for aggregation-only) |

Client Credentials with `ROLE_PARTNER` or `ROLE_PARTNER_READ` provides system-level access and does not act on behalf of an end user. This is the recommended grant type for SailPoint aggregation.

## Product Links

- [AppDirect website](<https://www.appdirect.com/>)
- [Developer Portal](<https://developer.appdirect.com/>)
- [API reference](<https://developer.appdirect.com/rest>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.