Integrating SailPoint with Chatwoot

Chatwoot is an open-source, omni-channel customer engagement platform that allows businesses to manage customer conversations across various channels like website live chat, email, Facebook, Twitter, and WhatsApp from a single dashboard. This document provides instructions to configure a new direct connection to a Chatwoot source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Supported Features

The Chatwoot connector supports the following:

Account Management

• Aggregate Accounts

  Note

  The managed system doesn’t provide APIs for aggregating entitlements (roles); only account aggregation is supported.

Supported Managed Sysytems

• Chatwoot: Cloud or self-hosted instances

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

• You must have an account with Administrator privileges in your Chatwoot instance to access API settings and manage integrations.
• A valid Chatwoot instance URL is required.
  • For Cloud users: https://app.chatwoot.com
  • For self-hosted users: Your custom domain (for example, https://chatwoot.yourdomain.com)
• A valid User API Access Token is required to authenticate requests. This token is unique to each user and determines the scope of data accessible through the API.
• Chatwoot primarily uses token-based authentication. The api_access_token must be included in the request headers for all API calls.
• For more information about authentication methods, refer Chatwoot API Guide. For instructions on locating your token, refer How to Find Your Personal Access Token.

Required Permissions

To integrate with Chatwoot, you must provide a valid User Access Token. The level of data accessible to the integration depends on the role assigned to the user who generates this token.

Service Account/API Credentials

• API tokens are generated per user. To obtain your token, go to Profile Settings > Access Token.
• We recommend that you use an account with the Administrator role. While standard Agents can generate tokens, their API access is restricted to their assigned conversations and basic profile data, which may prevent the connector from syncing all account-wide users and teams.

Scope Needed for Connector Operations

To ensure the connector can successfully fetch all user accounts, the following requirements apply:

• Only an Administrator can access the account-level endpoints required to fetch the full list of users and their team memberships. (The managed system doesn’t provide APIs for aggregating roles/entitlements.)
• For identity syncing, the token must have permission to read the Account and User resources. If the integration requires modifying memberships, the Administrator role is mandatory.

Relevant Roles

Chatwoot uses role-based access control (RBAC) rather than granular OAuth scopes for its standard API. Ensure the service account is assigned one of the following roles:

• Administrator: Provides full access to account-level APIs, including Users, Teams, Inboxes, and Account Settings (required for full synchronization).
• Agent: Provides limited access. Tokens generated by Agents generally can’t list other users or account-wide configurations.

For more information about finding your credentials and understanding Chatwoot’s permission model, refer the following resources:

• Chatwoot API Authentication Guide
• Managing User Roles in Chatwoot