# Integrating SailPoint with Castor EDC

Castor is an AI-native, cloud-based clinical trial platform built for biopharma companies, CROs, medical device manufacturers, and academic researchers to design, capture, manage, and structure clinical trial data at scale. It combines a core Electronic Data Capture (EDC) system with eCOA/ePRO for patient-reported outcomes, eConsent for remote enrollment, a Clinical Data Management System (CDMS) for cleaning and locking study data, and Castor Catalyst - an AI-driven extraction engine that turns source documents and EHR data into structured eCRF values with human review - into a single unified system. This document provides instructions to configure a new direct connection to a Castor EDC source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Castor EDC connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Roles

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before configuring the Castor EDC connector, ensure the following requirements are met:

1. Sign in to Castor at `https://data.castoredc.com` (or the region-specific server your study is hosted on).
2. Go to **Account Settings \> Castor EDC API** tab (accessible by hovering over **Account** in the top bar, then selecting **Settings**).
3. Generate an **API Client ID** and **Client Secret** from this tab. These credentials grant the same access to your data as your username and password, so store them securely (for example, in a password manager) and do not share them with third parties.
4. Authenticate using the OAuth2 **Client Credentials** flow to obtain an access token by running:

   ```text
   curl --location --request POST 'https://data.castoredc.com/oauth/token' \

   --header 'Content-Type: application/x-www-form-urlencoded' \

   --data-urlencode 'client_id=YOUR_CLIENT_ID' \

   --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \

   --data-urlencode 'grant_type=client_credentials'
   ```
5. Copy and securely store the returned **access token** - it is valid for **5 hours (18000 seconds)** before it expires and must be refreshed via the same token request once expired.
6. Copy and securely store the following details, required during connector configuration:

   - **Base URL**
   - **Client ID** and **Client Secret** - used to request new access tokens via the OAuth2 Client Credentials flow
   - **Access Token** - used as a `Bearer` token in the `Authorization` header for all subsequent API requests
   - **Study ID** - found in your study settings; required to scope requests to a specific study (for example, `/api/study/{study_id}/user`)

For more information, refer to the official [Castor EDC documentation](<https://data.castoredc.com/api>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

- **Organization Owner / Study Admin** - The account used to generate the Client ID and Secret should ideally hold an **Admin** role at the study level (or organization-level access, if managing multiple studies). This role is required to:

  - Generate API Client ID and Client Secret via Account Settings.
  - Fetch all users, roles, and role assignments across the study.