Integrating SailPoint with Huntress

Huntress is a cloud-based managed security platform for organizations that need continuous threat detection, investigation, and response across their endpoints, identities, and security data. It combines endpoint detection and response, identity threat detection and response, SIEM log source monitoring, and security awareness training into a single unified system, organized around accounts and the organizations they manage, providing centralized visibility into agents, incident reports, and the users who have been granted access to each organization. This document provides the instructions required to configure a new direct connection between SailPoint and Huntress. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Supported Features

The Huntress connector supports the following:

Account Management

• Aggregate Users

Entitlement Management

• Aggregate Permissions

Prerequisites

Before configuring the Huntress connector, ensure the following requirements are met:

1. Sign in to Huntress at <your_account_subdomain>.huntress.io with an account that has been granted access to the Huntress API.
2. Open the dropdown menu at the top-right corner of the site header and select API Credentials. This option is only shown if your account has been granted API access.
3. On the API Key generation page, select Setup to begin, then select Generate to create a public and private key pair for Huntress API access.
4. Copy the API Secret Key immediately and store it securely - it is only visible at this stage of key generation.
5. Retrieve the Organization ID as described in the following section.
6. Copy and securely store the following details, which are required during connector configuration:
   • API Key (public key) - entered as the connector's Username
   • API Secret Key (private key) - entered as the connector's Password
   • Base URL - https://api.huntress.io/v1
   • Organization ID

Retrieve the Organization ID from the Huntress API Reference

The Huntress portal lists organizations by name only; it does not display the numeric Organization ID. Retrieve the ID from the official Huntress API Reference, which can run the request directly in your browser - no Postman or other API client is required.

1. Open the Huntress API Reference.
2. In the sidebar, confirm that the REST API document is selected. The site also publishes a separate Webhooks document, which does not contain this endpoint.
3. Expand the Organizations tag in the sidebar and select List Organizations (GET /v1/organizations).

4. Locate the Authentication section. Huntress preselects its basic_auth security scheme, so the reference displays HTTP Basic fields. Enter the credentials generated in the previous steps:

   • Username - your Huntress API Key (public key)
   • Password - your Huntress API Secret Key (private key)

5. The reference builds the Authorization: Basic <Base64(api_key:api_secret)> header for you. Enter the raw key and secret; do not paste a pre-encoded Base64 string.

6. Select Test Request on the List Organizations operation. This opens the built-in API client for that request.
7. Confirm the selected server is https://api.huntress.io (Production).

8. Optionally set query parameters to narrow the results. All are optional:

   • name - filter by organization name. Use the name exactly as it appears on the Organizations tab of the Huntress portal.
   • limit - maximum number of records returned per page. Defaults to 10, minimum 1, maximum 500.
   • sort_field - field to sort by (id, created_at, updated_at, name, or key). Defaults to id.
   • sort_direction - asc or desc. Defaults to desc.

9. Select Send to execute the request against your Huntress account.

10. Confirm that the response status is 200, then read the Organization ID from the response body as described below.

Read the ID from the Response

The list response has organizations and pagination. Copy id for the organization whose name matches the tenant you are connecting:

{
  "organizations": [
    {
      "id": 1,
      "name": "Acme Inc.",
      "key": "test1",
      "account_id": 5
    }
  ],
  "pagination": {
    "next_page_token": null,
    "next_page_url": null
  }
}

Enter that numeric id (for example 1) in the connector Organization ID field. Do not use key or account_id.

If pagination.next_page_token is present in the response, more organizations exist. Run Test Request again with the page_token query parameter set to that value, and repeat until next_page_token is null. The response also returns pagination.next_page_url, which is the same request already formatted as a URL.

Confirm a Single Organization

To verify the value before entering it in the connector, select Get Organization (GET /v1/organizations/{id}) under the same Organizations tag, set the id path parameter to the value you copied, and select Send.

A 200 response containing "organization": { "id": ..., "name": "..." } with the expected name confirms the value.

Common Errors

Token Notes

For more detailed information on obtaining an access token, refer to the official Huntress documentation: Huntress API Reference.

Required Permissions

Typical Roles That Can Generate Tokens

Huntress grants each membership one of the following permission labels: Admin, Security Engineer, User, Read-only, Finance, Marketing, Admin-Read-only, and Provisioner.

• API-enabled account - Required at minimum. Huntress states that the API Credentials option appears in the account dropdown only if your account has been granted access to the Huntress API. Generating a key pair is gated on that API access grant rather than on a named role.