Skip to content

Integrating SailPoint with DeployHQ

DeployHQ is a cloud-based deployment automation platform that helps engineering teams build, package, and deliver code from Git repositories (GitHub, GitLab, Bitbucket, and self-hosted Git) to servers, cloud storage, and S3-compatible targets over SSH, SFTP, and other protocols. This document provides instructions to configure a new direct connection to a DeployHQ source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The DeployHQ connector supports the following:

Account Management

  • Aggregate Users

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

  • A DeployHQ user with Account Administrator rights. Account administrators have full visibility over all users and account-level permissions, which is required to aggregate the complete user list and the permission flags exposed in the account schema.
  • The DeployHQ account URL (tenant base URL) in the form https://{tenant}.deployhq.com. This is the value that will be supplied to the connector as the base URL.
  • For more information about the DeployHQ API, refer to the following resources:

Required Permissions

  • It is recommended to create a dedicated DeployHQ user that will act as the integration service account, rather than reusing a personal user identity. This makes credential rotation and audit traceability easier.
  • The service account must be granted Account Administrator privileges in DeployHQ. Only users with account administrator rights can list and inspect all users on the account through the API.
  • Generate an API key for the service account from the DeployHQ user profile/security settings, and use HTTP Basic authentication with:
    • Username - The service account's login username/email
    • Password - The service account's API key (preferred) or password
  • Non-administrator users can typically authenticate to the API but can only see themselves or limited team metadata; they cannot be used to drive full account aggregation.
  • Read access to all users on the DeployHQ account is required so that account aggregation returns every user, not just the authenticated identity.

Read access to account-level permission flags is required so that attributes such as account_administrator , can_manage_users , can_manage_billing , can_create_projects , can_manage_agents , all_projects_allowed , and activated are populated correctly.

Note: DeployHQ does not expose dedicated roles/groups/teams APIs through this connector, no entitlement aggregation is performed; the connector only needs read scope on the Users endpoint.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.