# Integrating SailPoint with Celigo

Celigo is an integration platform used to build, run, and monitor integrations and data flows. Celigo controls workspace access with an account-wide `accessLevel` and with per-integration access through `integrationAccessLevel`. This document covers how to configure a new direct connection between SailPoint and Celigo for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Celigo connector supports the following:

### Account Management

- Aggregate Celigo workspace users

> [!NOTE]
>
> This connector is read-only. It supports test connection and account aggregation for Quick Compliance. It does not create, update, disable, or delete users. The connector does not aggregate separate entitlement objects. `accessLevel`, `integrationIds`, and `integrationRoles` are account attributes. The Celigo account owner is not aggregated. End users are not returned. SailPoint correlates accounts to identities by email.

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before you configure the Celigo connector, ensure the following requirements are met:

1. Identify the Celigo account or environment to aggregate, including its region and API base URL.
2. Sign in to Celigo. Go to **Resources \> API tokens**.
3. Select **Generate token**. Create a bearer token that can read invited workspace users.
4. Record these values for SailPoint:

   - **Base URL**
   - **API Token**

> [!NOTE]
>
> - Authentication type is Bearer API Token.
> - Use the regional API base URL that includes `/v1`. Do not include `/ashares`.
> - Regional Base URL examples:
>
>   - US: `https://api.integrator.io/v1`
>   - EU: `https://api.eu.integrator.io/v1`
>   - AU: `https://api.au.integrator.io/v1`
>   - CA: `https://api.ca.integrator.io/v1`
> - Tokens are region- and environment-specific.

## Required Permissions

The credential must be able to read invited-user access records for the account or environment you govern. SailPoint recommends a full-access service token for complete aggregation. You can also use a custom service token or a Personal Access Token (PAT). A custom token may not expose account users if its resources are limited. A PAT inherits the permissions of its owner. For more information about Celigo, refer to the following:

- [Celigo website](<https://www.celigo.com/>)
- [Celigo Help Center](<https://docs.celigo.com/>)
- [Celigo API documentation](<https://developer.celigo.com/api>)
- [Users API](<https://developer.celigo.com/api/api-reference/users>)
- [Manage account and integration permissions](<https://docs.celigo.com/hc/en-us/articles/115003929872-Manage-user-roles-permissions-to-an-account>)
- [Manage API tokens](<https://docs.celigo.com/hc/en-us/articles/360019782431-Managing-API-tokens>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.