# Integrating SailPoint with Kashoo

Kashoo is a cloud accounting platform where businesses manage financial data and user access. Each business has users with assigned access roles (for example, Owner, Admin, View Only). The Kashoo connector enables SailPoint to aggregate users for a single Kashoo business and the access role assigned to each user for that business. This document provides the instructions required to configure a new direct connection between SailPoint and Kashoo. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Kashoo connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Access roles

> [!NOTE]
>
> Roles are modeled as an account entitlement on the `role` attribute (not a separate Group schema). There is no separate entitlement aggregation command; role values are collected with account aggregation from business `userRoles`.

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Scope Model

This connector is business-scoped. You provide a Business ID (`businessId`) in connection settings. Aggregation reads only users and roles for that business.

- Roles are assigned per business membership (`userRole`), not as a separate global group catalog.
- One SailPoint source equals one Kashoo business. To govern multiple businesses, create multiple sources.

## Prerequisites

Before you configure the Kashoo connector, ensure the following requirements are met:

1. Sign in at [Kashoo](<https://app.kashoo.com/>) with a Kashoo user that can access the target business (typically Owner, Admin, or Creator).
2. Complete any required account setup (for example phone verification if you need to manage users in the Kashoo UI).
3. Identify the Business ID for the business you want to aggregate from the Kashoo web app URL:

   1. Sign in at [Kashoo](<https://app.kashoo.com/>).
   2. Open the business you want to connect.
   3. Look at the browser address bar for a numeric ID in the path or query (for example pages or requests under `/businesses/<BusinessID>/...`).
   4. That number is your Business ID - enter it in SailPoint Connection Settings. (Optional) If the ID is not visible in the URL:
   5. Open browser DevTools and select **Network**.
   6. Select around the business dashboard or settings.
   7. Find API requests to `/api/businesses/{businessId}/...`.
   8. Use the `{businessId}` value from those requests. You do not need Postman or other API testing tools to find the Business ID for connector setup.
4. Confirm you have the Kashoo login email and password for the service or admin user that SailPoint will use.
5. Confirm the API base URL (default): `https://app.kashoo.com/api`.

> [!NOTE]
>
> - Kashoo authentication for this connector uses Custom Authentication (password grant style) against `POST https://app.kashoo.com/api/authTokens/oauth2/token`.
> - Request body (JSON): `grant_type=password`, `email`, `password`, and `site=app.kashoo.com`.
> - The response includes `access_token`. API calls use `Authorization: Bearer $application.access_token$`.
> - Tokens are short-lived; the connector obtains a new token during Custom Authentication as needed.
> - MFA (if enabled on the Kashoo user) can block token generation until handled in Kashoo.

## Required Permissions

Use a Kashoo user that is a member of the target business with sufficient access to list business users and roles (typically Owner, Admin, or Creator).

| Kashoo Business Role (Examples) | Effect on Connector |
| --- | --- |
| CREATOR / OWNER / ADMIN | Can typically authenticate and list users for the business. |
| VIEW\_EDIT\_ONLY / VIEW\_ONLY / others | May authenticate, but listing `/businesses/{id}/userRoles` can fail depending on privileges. |
| NO\_ACCESS / DISABLED\_ACCESS | Not suitable for the connector service account. |

The connector is read-only (aggregation only). It does not create, update, or delete Kashoo users.

### Membership Access Roles

Access roles are aggregated from the top-level `role` field on each business `userRole` response (membership), for example from `GET /businesses/{businessId}/userRoles`.

| API Role Value | Typical Meaning |
| --- | --- |
| CREATOR | Created the business; full control. |
| OWNER | Business owner privileges. |
| ADMIN | Administers users and business settings. |
| LIMITED\_OWNER | Limited owner privileges. |
| VIEW\_EDIT\_ONLY | Can view and edit, without full admin control. |
| VIEW\_ONLY | Read-only access. |
| NO\_ACCESS | No access to the business. |
| DISABLED\_ACCESS | Access disabled. |

For more information about Kashoo, refer to the following:

- [Kashoo website](<https://www.kashoo.com/>)
- [Kashoo app](<https://app.kashoo.com/>)
- [Kashoo API documentation](<https://api.kashoo.com/>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.