# Integrating SailPoint with Attio

Attio is a cloud CRM that manages **workspace members** and their **access level** in a workspace. The Attio connector is a **read-only** connector. It provides limited governance for your Attio system: user aggregation and role (access level) visibility for Quick Compliance. This document provides the instructions required to configure a new direct connection between SailPoint and Attio. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Attio connector supports the following:

### Account Management

- Aggregate Workspace members

### Entitlement Management

- Aggregate Access level - role in the Attio workspace: admin, member, or suspended

> [!NOTE]
>
> This connector is read-only. It supports account aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported in this release. Access level values are collected during account aggregation.

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Key Implementation Notes

- Each member has **one** access level.
- Attio does **not** delete workspace members. Suspended people still appear as accounts, with access level `suspended`.
- SailPoint correlates the Attio account to an identity using **email**.
- One SailPoint source = one Attio workspace (the workspace that issued the API token).
- There is no separate catalog of roles in Attio. Access level is read from each member and shown as an entitlement on the account.

## Prerequisites

Before configuring the Attio connector, ensure the following requirements are met:

1. Sign in at an [Attio workspace](<https://app.attio.com/>).
2. An **admin** in that workspace. Only admins can create API keys.
3. A workspace **access token** (API key) with permission to view workspace members.
4. You have a Base URL.

### Create the API Token

1. Sign in to Attio as a workspace **admin**.
2. Select the dropdown beside your workspace name and select **Workspace settings**.
3. Select the **Developers** tab.
4. Select **New access token**.
5. Add a token name (for example, `SailPoint`).
6. Set scopes so the token can **view workspace members**. Include `user_management:read`. You do not need write scopes for this connector.
7. Copy the token and store it securely. You will paste it into the SailPoint **API Token** field.

> [!NOTE]
>
> Treat the token like a password. If you delete or replace the token in Attio, update the source in SailPoint. Tokens do not expire until an admin deletes them.

## Required Permissions

| Who | Access |
| --- | --- |
| **Attio workspace admin** | Can create and manage API tokens in **Workspace settings \> Developers** |
| **API token with user\_management:read** | Recommended. Can list workspace members for aggregation |
| **API token without user-management scope** | Test Connection and account aggregation fail |
| **Non-admin Attio user** | Cannot create the API token |

You only need **read** access. This connector does not write to Attio.

For more detailed information on Attio API authentication, refer to the following resources:

- [Attio website](<https://attio.com/>)
- [Generating an API Key](<https://attio.com/help/apps/other-apps/generating-an-api-key>)
- [Attio API Authentication](<https://docs.attio.com/rest-api/guides/authentication>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.