# SailPoint Dato CMS Connector Documentation

> Dato CMS Documentation

# Documentation

# Connecting SailPoint and DatoCMS

To connect SailPoint to the source, perform the following tasks:

## Adding and Configuring the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

1. Go to **Admin \> Connections \> Sources**.
2. Select **Create New**.
3. Search for a source type and select **Actions**.
4. In the **Actions** dropdown, select the setup method:

   - **Express Setup** - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - **Standard Setup** - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Express Setup

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated source name, source owner, and description. To update, select **Edit**.

   > **Note**
   >
   > Source name must be unique.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** page.
5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Standard Setup

Configure more detailed settings relative to Express Setup.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Here, continue to configure your connected source.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a descriptive **Source Name** for the connection.
2. Enter the **Source Description** that provides details necessary to distinguish it from similar connection sources.
3. In **Source Owner**, begin typing the name of the source owner.
4. (Optional) Select the appropriate **Governance Group for Source Management** from the dropdown list. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
5. Select **Create Manual Work Items** to enable the source to support additional source management features such as creating accounts and access profile management.

   > **Important**
   >
   > Once you enable this feature, it can't be disabled.

   For more information on manual work items, refer to [Work Items](<https://developer.sailpoint.com/docs/api/work-items>). For more information on SailPoint features, refer to [SailPoint Identity Services](<https://documentation.sailpoint.com/saas/help/index.html>).
6. Select **Save**.

## Connection Settings

Configure a secured, direct connection to the source.

1. Enter the DatoCMS API base endpoint as **Base URL**. For example, `https://site-api.datocms.com`.
2. Enter the **API Token** generated from the Dato CMS **Project Settings**. This token is used to authenticate requests made by the connector.
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Integrating SailPoint with Dato CMS

DatoCMS is a cloud-based, headless Content Management System (CMS) designed for developers and content teams to build, manage, and deliver structured content across websites, applications, and digital platforms.

It provides a flexible content modeling system, powerful GraphQL and REST APIs, real-time preview capabilities, role-based access control, and localization support, enabling seamless collaboration between technical and non-technical users.

DatoCMS integrates easily with modern frontend frameworks such as Next.js and Nuxt, supports static site generators, and offers webhook-based automation for CI/CD workflows. With built-in media management, environment-based deployments, and scalable infrastructure, DatoCMS enables organizations to manage omnichannel content efficiently while maintaining performance, security, and developer flexibility.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The DatoCMS connector supports the following:

### Account Management

- Aggregate Account (Users)

### Entitlement Management

- Aggregate Group (Roles)

## Prerequisites

### Creating an API Token in DatoCMS

Every project includes a read-only API token by default. You can also create a custom API token with the appropriate permissions. Roles can be used to define granular access levels and control exactly what each token is allowed to do.

Follow the steps below to generate an API token for integration:

1. Log in to **DatoCMS**.
2. Open your **Project**.
3. Navigate to **Project Settings → API Tokens**.
4. Click **Add a new API token**.
5. Enter a meaningful name for the token.
6. Under **Role associated with this API token**, select:

   - **Admin** (recommended for full access use cases such as user and role aggregation).
7. Enable the following permissions:

   - Access the **Content Delivery API**
   - Access the **Content Delivery API in Preview Mode**
   - Access the **Content Management API**
8. Click **Save** to generate the token.
9. Copy the generated token immediately and store it securely.

#### Permission Explanation

- **Content Delivery API** - Allows read access to published content.
- **Content Delivery API (Preview Mode)** - Allows access to draft/ unpublished content.
- **Content Management API** - Required for administrative operations, metadata access, content updates, and integration use cases.

> [!NOTE]
>
> For more detailed information on obtaining an access token, refer to the official [Dato CMS documentation](<https://www.datocms.com/docs/content-management-api/authentication>).

## Required Permissions

- Custom Role Configuration (Performed by Admin)

  For non-admin accounts to generate API tokens, the assigned custom role must include the appropriate permission.
- Enabling API Token Creation

  When creating or updating a custom role, the Admin must explicitly enable the permission that allows users to:

  - Create or Edit API Tokens Once this permission is enabled and the role is assigned to a user, that user will be able to generate API tokens.

    This is particularly important for service accounts that require API-based access.

> [!IMPORTANT]
>
> - API tokens inherit the exact permissions of the role assigned to the user within the project.
> - If a user does not have access to specific content models or records in the DatoCMS UI, the API token generated by that user will also be restricted from accessing those resources.
> - An Admin must explicitly enable the token management permission for any role that is intended to generate API tokens.

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Dato CMS connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| id | Account |

### Default Account Attributes

The Dato CMS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| role\_id | Role assigned to the user in DatoCMS |
| is\_active | Indicates whether the user account is active |
| full\_name | Full name of the user |
| last\_access | Timestamp when the user account was last accessed |
| id | Unique identifier for the user in DatoCMS |
| type | Resource type identifier in DatoCMS API |
| email | Email address of the user |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The Dato CMS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| role\_id | Unique identifier for role |
| is\_active | A permission profile assigned to collaborators that determines their access level and actions within a project. |
| can\_manage\_users | Allows creating, editing, and removing users in the project. |
| can\_manage\_access\_tokens | Allows generating, viewing, and revoking API access tokens. |
| can\_manage\_sso | Allows configuring and managing Single Sign-On settings. |
| can\_manage\_environments | Allows creating, deleting, or modifying project environments (e.g., staging, production). |
| can\_edit\_schema | Allows modifying content models, fields, and overall schema structure. |
| can\_edit\_site | Allows changing general project/site settings and configurations. |
| environments\_access | Defines which environments (primary, all, etc.) the role can access. |
| can\_promote\_environments | Allows promoting changes from one environment to another (e.g., staging → production). |
| can\_manage\_webhooks | Allows creating and managing webhooks for event notifications. |
| can\_manage\_build\_triggers | Allows configuring and managing build trigger events. |
| can\_manage\_search\_indexes | Allows creating and managing search index configurations.ws creating and managing search index configurations. |
| can\_manage\_shared\_filters | Allows creating and editing shared content filters. |
| can\_manage\_upload\_collections | Allows managing media/upload collections and folders. |
| can\_manage\_menu | Allows customizing the CMS navigation/menu structure. |
| can\_manage\_workflows | Allows creating and managing editorial workflows and statuses. |
| can\_access\_audit\_log | Allows viewing audit logs of system activities and changes. |
| can\_access\_build\_events\_log | Allows viewing logs related to build events. |
| can\_access\_search\_index\_events\_log | Allows viewing logs for search indexing events. |
| can\_perform\_site\_search | Allows using the internal site search functionality. |