# Integrating SailPoint with AppFollow

AppFollow is an app store optimization (ASO) and app review management platform that helps mobile teams monitor app performance, track reviews and ratings, and manage keyword rankings across app stores. It brings review management, ASO research, rating analytics, and app metadata tracking into a single system, providing real-time visibility into app performance and user sentiment. This document provides instructions to configure a new direct connection to an AppFollow source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The AppFollow connector supports the following:

### Account Management

- Aggregate Account (Users)

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before configuring the AppFollow connector, ensure the following prerequisites are met:

1. Sign in to AppFollow with an **Admin** or **Owner** account.
2. Go to **Integrations \> API Dashboard**.
3. Select **Add new token**.
4. Enter a unique **Token Name**.
5. Select the required permissions for the token:

   - **Read** - for data aggregation and reporting
   - **Write** - for provisioning or data modification use cases
   - **Delete** - for de-provisioning or record removal use cases
6. Select the workspace scope for the token:

   - **All workspaces**, or
   - One or more specific workspaces
7. Select **Save** to generate the API token.
8. Copy the token immediately and store it securely, as it may not be displayed again.
9. Record the following values for SailPoint configuration:

   - **Base URL**
   - **API Token**

> [!IMPORTANT]
>
> Permissions (**Read**, **Write**, **Delete**) and workspace scope are defined individually when the token is created. A token can perform only the operations and access only the workspaces explicitly granted at creation time. It does not automatically inherit all access available to the user who created it. If token permissions or workspace scope must change later, generate a new token with the correct settings. Existing tokens typically cannot be re-scoped after creation.

## Required Permissions

### Who Can Generate Tokens

Only AppFollow users with the **Admin** or **Owner** role can generate an API token.

API Dashboard access and token creation are restricted to users with the **Admin** or **Owner** role. API tokens are explicitly scoped at creation time and are not inherited from the full UI permissions of the user who creates them.

- **Admin** and **Owner** users can generate API tokens.
- **User**, **Support Agent**, **Support Manager**, and **Read Only** users cannot generate API tokens.

### How Token Scope Works

API tokens are explicitly scoped at creation time and are not inherited from the full UI permissions of the user who creates them.

Each token is scoped to:

- A permission level: **Read**, **Write**, and/or **Delete**
- One or more workspaces, or **All workspaces**

The token can perform only the selected operations and access only the selected workspace data, regardless of any broader access held by the creating user in the AppFollow interface.

> [!NOTE]
>
> The **role** value is exposed as an entitlement attribute within the account schema. The connector does not aggregate a separate Group or Role schema object because AppFollow does not provide a separate endpoint for retrieving roles.

> [!NOTE]
>
> AppFollow roles are fixed system-defined values and are not managed by this connector. The supported roles are **Admin**, **Owner**, **User**, **Support Agent**, **Support Manager**, and **Read Only**. These roles cannot be created, renamed, or customized.

## Key Implementation Notes

- AppFollow roles are the entitlement model exposed by this connector.
- Role values are predefined by AppFollow and are not customer-configurable.
- API access depends on both permission scope and workspace scope.
- If aggregation or provisioning behavior does not match expectations, verify the token scope first.

## References

- [AppFollow](<https://appfollow.io>)
- [AppFollow API Reference](<https://docs.api.appfollow.io/reference/overview>)
- [AppFollow API Overview](<https://support.appfollow.io/hc/en-us/articles/360020833017-API-Overview>)
- [User Roles and Permissions](<https://support.appfollow.io/hc/en-us/articles/360020979618-User-Roles-and-Permissions>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.