# Integrating SailPoint with Huntress Huntress is a cloud-based managed security platform for organizations that need continuous threat detection, investigation, and response across their endpoints, identities, and security data. It combines endpoint detection and response, identity threat detection and response, SIEM log source monitoring, and security awareness training into a single unified system, organized around accounts and the organizations they manage, providing centralized visibility into agents, incident reports, and the users who have been granted access to each organization. This document provides the instructions required to configure a new direct connection between SailPoint and Huntress. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](). > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Huntress connector supports the following: ### Account Management - Aggregate Users ### Entitlement Management - Aggregate Permissions > [!IMPORTANT] > > Quick Compliance connectors have the following manual aggregation limits within a 24-hour period: > > - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization. > - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source. > > These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support. ## Prerequisites Before configuring the Huntress connector, ensure the following requirements are met: 1. Sign in to Huntress at `.huntress.io` with an account that has been granted access to the Huntress API. 2. Open the dropdown menu at the top-right corner of the site header and select **API Credentials**. This option is only shown if your account has been granted API access. 3. On the API Key generation page, select **Setup** to begin, then select **Generate** to create a public and private key pair for Huntress API access. 4. Copy the **API Secret Key** immediately and store it securely - it is only visible at this stage of key generation. 5. Retrieve the Organization ID as described in the following section. 6. Copy and securely store the following details, which are required during connector configuration: - **API Key** (public key) - entered as the connector's **Username** - **API Secret Key** (private key) - entered as the connector's **Password** - **Base URL** - `https://api.huntress.io/v1` - **Organization ID** ### Retrieve the Organization ID from the Huntress API Reference The Huntress portal lists organizations by name only; it does not display the numeric Organization ID. Retrieve the ID from the official Huntress API Reference, which can run the request directly in your browser - no Postman or other API client is required. 1. Open the [Huntress API Reference](). 2. In the sidebar, confirm that the **REST API** document is selected. The site also publishes a separate **Webhooks** document, which does not contain this endpoint. 3. Expand the **Organizations** tag in the sidebar and select **List Organizations** (`GET /v1/organizations`). 4. Locate the **Authentication** section. Huntress preselects its `basic_auth` security scheme, so the reference displays HTTP Basic fields. Enter the credentials generated in the previous steps: - **Username** - your Huntress **API Key** (public key) - **Password** - your Huntress **API Secret Key** (private key) 5. The reference builds the `Authorization: Basic ` header for you. Enter the raw key and secret; do not paste a pre-encoded Base64 string. 6. Select **Test Request** on the **List Organizations** operation. This opens the built-in API client for that request. 7. Confirm the selected server is `https://api.huntress.io` (**Production**). 8. Optionally set query parameters to narrow the results. All are optional: - `name` - filter by organization name. Use the name exactly as it appears on the **Organizations** tab of the Huntress portal. - `limit` - maximum number of records returned per page. Defaults to `10`, minimum `1`, maximum `500`. - `sort_field` - field to sort by (`id`, `created_at`, `updated_at`, `name`, or `key`). Defaults to `id`. - `sort_direction` - `asc` or `desc`. Defaults to `desc`. 9. Select **Send** to execute the request against your Huntress account. 10. Confirm that the response status is **200**, then read the Organization ID from the response body as described below. > [!NOTE] > > The API Reference stores the credentials you enter in your browser so they persist across page reloads. Clear the **Username** and **Password** fields when you are finished, especially on a shared machine. ### Read the ID from the Response The list response has `organizations` and `pagination`. Copy `id` for the organization whose `name` matches the tenant you are connecting: ```text { "organizations": [ { "id": 1, "name": "Acme Inc.", "key": "test1", "account_id": 5 } ], "pagination": { "next_page_token": null, "next_page_url": null } } ``` Enter that numeric `id` (for example `1`) in the connector **Organization ID** field. Do not use `key` or `account_id`. If `pagination.next_page_token` is present in the response, more organizations exist. Run **Test Request** again with the `page_token` query parameter set to that value, and repeat until `next_page_token` is `null`. The response also returns `pagination.next_page_url`, which is the same request already formatted as a URL. ### Confirm a Single Organization To verify the value before entering it in the connector, select **Get Organization** (`GET /v1/organizations/{id}`) under the same **Organizations** tag, set the `id` path parameter to the value you copied, and select **Send**. A `200` response containing `"organization": { "id": ..., "name": "..." }` with the expected name confirms the value. ### Common Errors | Status | Meaning | | --- | --- | | 401 | The request could not be authenticated. Check that the API Key and API Secret Key are entered correctly in the **Username** and **Password** fields. | | 403 | There was an issue with your API credential or permissions. Use a key generated by an account with access to the organizations you are listing. | | 429 | More than 60 requests were made within the rate limit timeframe. Wait and retry. | ### Token Notes > [!NOTE] > > - The Huntress API implements **basic access authentication**. Credentials are sent as `Authorization: Basic [Base64Encode(:)]`. The connector's **Username** and **Password** fields therefore correspond to the **API Key** and **API Secret Key** - not to Huntress portal sign-in credentials. > - The **API Secret Key is only displayed once**, during generation. If the value is lost, you must regenerate your API credentials at `.huntress.io/account/api_credentials` and update the source with the new key pair. > - Every Huntress API account is rate limited to **60 requests per minute on a sliding window**; exceeding it returns a `429` response. The connector retries a `429` response up to **3 times with a 30-second delay** between attempts. For more detailed information on obtaining an access token, refer to the official Huntress documentation: [Huntress API Reference](). > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. ## Required Permissions ### Typical Roles That Can Generate Tokens Huntress grants each membership one of the following permission labels: **Admin**, **Security Engineer**, **User**, **Read-only**, **Finance**, **Marketing**, **Admin-Read-only**, and **Provisioner**. - **API-enabled account** - Required at minimum. Huntress states that the **API Credentials** option appears in the account dropdown only if your account has been granted access to the Huntress API. Generating a key pair is gated on that API access grant rather than on a named role.