# Integrating SailPoint with Celonis

Celonis is a process mining and execution management platform that helps organizations analyze, monitor, and optimize their business processes. This document provides instructions to configure a new direct connection to a Celonis source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Celonis connector supports the following:

### Account Management

- Aggregate Users

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

- A Celonis Platform team with the Team API enabled and an OAuth 2.0 client application created from **Team Settings \> Applications**.
- The OAuth client must be configured for the **Client Credentials** grant type.
- The OAuth client must be granted the `team.user-group-info:read` and `team.login-history:read` scope and assigned a platform role that allows reading the team’s members (for example, a member role on the team).
- The following credentials and URLs are required to set up the source:

  - **Base URL** of the Celonis team.
  - **Token URL** of the Celonis team.
  - **Client ID** of the OAuth 2.0 application.
  - **Client Secret** of the OAuth 2.0 application.
- An administrator account in your SailPoint tenant to create and configure the source.
- For more information about OAuth client registration and Team APIs, refer to the following resources:

  - [Registering your OAuth client in the Celonis Platform](<https://docs.celonis.com/en/registering-oauth-client.html>)
  - [Celonis Team APIs](<https://developer.celonis.com/celonis-apis/team-api/overview>)

## Required Permissions

- Only a Celonis Platform team administrator can go to **Admin &amp; Settings \> Applications** to create a new OAuth client (**Add new application \> OAuth Client**) and obtain the **Client ID** and **Client Secret**.
- The connector calls the Celonis Team API, which requires the OAuth client to request the `team.user-group-info:read` and `team.login-history:read` scope at token-generation time. Without this scope on the issued access token, the Celonis Team API returns `HTTP 403` and account aggregation cannot proceed.
- In the Celonis Platform, assign the OAuth client the `User Group Info API` permission so the `team.user-group-info:read` scope can actually access the underlying members data.
- For convenience, the connector ships with the scope value `team.user-group-info:read team.login-history:read`, so granting `team.login-history:read` (Team Login History API) in addition to User Group Info is optional but supported.
- For more information about authentication and API endpoints, refer to the following resources:

  - [Celonis Authentication Overview (OAuth 2.0)](<https://developer.celonis.com/celonis-apis/auth>)
  - [Registering your OAuth client in the Celonis Platform](<https://docs.celonis.com/en/registering-oauth-client.html>)
  - [Celonis Team Members API](<https://developer.celonis.com/celonis-apis/team-api/openapi/openapi/members-api/getmemberprofileexternaltransport>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.