Skip to content

Integrating SailPoint with Castor EDC

Castor is an AI-native, cloud-based clinical trial platform built for biopharma companies, CROs, medical device manufacturers, and academic researchers to design, capture, manage, and structure clinical trial data at scale. It combines a core Electronic Data Capture (EDC) system with eCOA/ePRO for patient-reported outcomes, eConsent for remote enrollment, a Clinical Data Management System (CDMS) for cleaning and locking study data, and Castor Catalyst - an AI-driven extraction engine that turns source documents and EHR data into structured eCRF values with human review - into a single unified system. This document provides instructions to configure a new direct connection to a Castor EDC source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Castor EDC connector supports the following:

Account Management

  • Aggregate Users

Entitlement Management

  • Aggregate Roles

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before configuring the Castor EDC connector, ensure the following requirements are met:

  1. Sign in to Castor at https://data.castoredc.com (or the region-specific server your study is hosted on).
  2. Go to Account Settings > Castor EDC API tab (accessible by hovering over Account in the top bar, then selecting Settings).
  3. Generate an API Client ID and Client Secret from this tab. These credentials grant the same access to your data as your username and password, so store them securely (for example, in a password manager) and do not share them with third parties.

  4. Authenticate using the OAuth2 Client Credentials flow to obtain an access token by running:

    curl --location --request POST 'https://data.castoredc.com/oauth/token' \

--header 'Content-Type: application/x-www-form-urlencoded' \

--data-urlencode 'client_id=YOUR_CLIENT_ID' \

--data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \

--data-urlencode 'grant_type=client_credentials'

  5. Copy and securely store the returned access token - it is valid for 5 hours (18000 seconds) before it expires and must be refreshed via the same token request once expired.

  6. Copy and securely store the following details, required during connector configuration:
    • Base URL
    • Client ID and Client Secret - used to request new access tokens via the OAuth2 Client Credentials flow
    • Access Token - used as a Bearer token in the Authorization header for all subsequent API requests
    • Study ID - found in your study settings; required to scope requests to a specific study (for example, /api/study/{study_id}/user)

For more information, refer to the official Castor EDC documentation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

  • Organization Owner / Study Admin - The account used to generate the Client ID and Secret should ideally hold an Admin role at the study level (or organization-level access, if managing multiple studies). This role is required to:
    • Generate API Client ID and Client Secret via Account Settings.
    • Fetch all users, roles, and role assignments across the study.