# Integrating SailPoint with Astronomer

Astronomer is a managed data orchestration platform built on Apache Airflow, used to author, schedule, and monitor data pipelines across organizations, workspaces, and deployments. The Astronomer connector aggregates the users in an Astronomer organization along with the organization-level role granted to each user, so that SailPoint can govern access to the Astronomer organization. This document provides instructions to configure a new direct connection to an Astronomer source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Astronomer connector supports the following:

- Account Aggregation (the `organizationRole` is aggregated as a managed entitlement as part of the Account).

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

- You have an active Astronomer organization.
- You have a user with **Organization Owner** access.
- You have generated an **API token** (Organization-level) from the Astronomer Cloud UI.
- You have your **Settings \> General \> Organization ID** from the Astronomer Cloud UI.

### Generate an API Token

1. Sign in to the [Astronomer Cloud UI](<https://cloud.astronomer.io>).
2. Select your Organization, then go to **Settings \> Access Management \> API Tokens**.
3. Select **Add Organization API Token**.
4. Provide a name, an expiry, and assign the **Organization Member** (or higher) role. The token needs read access to the organization's users.
5. Copy and securely store the token. The Cloud UI only displays it once.

> [!IMPORTANT]
>
> **Resource Link**
>
> For more information about authenticating to Astro using API tokens, refer to the [Astronomer Authentication documentation](<https://www.astronomer.io/docs/astro/automation-authentication>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

The API token used for this integration must have sufficient access to read the organization's user data.

- The token must be an **Organization-level** token with at least the `ORGANIZATION_MEMBER` role, which grants read access to the `/v1/organizations/{organizationId}/users` endpoint.
- Workspace-level and Deployment-level tokens are **not** sufficient, as they cannot list organization users.

**Official References:**

- [Astronomer Platform API - List Users](<https://www.astronomer.io/docs/api/platform-api-reference/user/list-users>)
- [Astronomer User Roles and Permissions](<https://www.astronomer.io/docs/astro/user-permissions>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.