# Integrating SailPoint with DeployHQ

DeployHQ is a cloud-based deployment automation platform that helps engineering teams build, package, and deliver code from Git repositories (GitHub, GitLab, Bitbucket, and self-hosted Git) to servers, cloud storage, and S3-compatible targets over SSH, SFTP, and other protocols. This document provides instructions to configure a new direct connection to a DeployHQ source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The DeployHQ connector supports the following:

### Account Management

- Aggregate Users

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

- A DeployHQ user with **Account Administrator** rights. Account administrators have full visibility over all users and account-level permissions, which is required to aggregate the complete user list and the permission flags exposed in the account schema.
- The DeployHQ account URL (tenant base URL) in the form `https://{tenant}.deployhq.com`. This is the value that will be supplied to the connector as the base URL.
- For more information about the DeployHQ API, refer to the following resources:

  - [The DeployHQ API](<https://www.deployhq.com/support/api>)
  - [DeployHQ Users API](<https://www.deployhq.com/support/api/users-api>)

## Required Permissions

- It is recommended to create a dedicated DeployHQ user that will act as the integration service account, rather than reusing a personal user identity. This makes credential rotation and audit traceability easier.
- The service account must be granted **Account Administrator** privileges in DeployHQ. Only users with account administrator rights can list and inspect all users on the account through the API.
- Generate an API key for the service account from the DeployHQ user profile/security settings, and use HTTP Basic authentication with:

  - **Username** - The service account's login username/email
  - **Password** - The service account's API key (preferred) or password
- Non-administrator users can typically authenticate to the API but can only see themselves or limited team metadata; they cannot be used to drive full account aggregation.
- **Read access to all users on the DeployHQ account** is required so that account aggregation returns every user, not just the authenticated identity.

**Read access to account-level permission flags** is required so that attributes such as account\_administrator , can\_manage\_users , can\_manage\_billing , can\_create\_projects , can\_manage\_agents , all\_projects\_allowed , and activated are populated correctly.

**Note:** DeployHQ does not expose dedicated roles/groups/teams APIs through this connector, no entitlement aggregation is performed; the connector only needs read scope on the Users endpoint.

- For more information about API authentication and usage, refer to the following resources:

  - [DeployHQ Users API](<https://www.deployhq.com/support/api/users-api>)
  - [Using the DeployHQ API in scripts](<https://www.deployhq.com/support/scripting>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.