Skip to content

Integrating SailPoint with Kommo

Kommo (formerly amoCRM) is a cloud-based, messenger-first CRM platform that helps sales and support teams manage Leads, Contacts, Companies, and Tasks through customizable Pipelines. The Kommo connector aggregates Kommo users and their associated Roles for account and entitlement visibility. This document provides instructions to configure a new direct connection to a Kommo source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Kommo connector supports the following:

Account Management

  • Aggregate Users

Entitlement Management

  • Aggregate Roles

Note

Kommo's dashboard exposes a separate "Group" concept (for example, "Sales Office") that scopes team-wide data visibility. This is not supported as a manageable entitlement by this connector, because Kommo has no dedicated /groups endpoint - group_id is only readable as a foreign key on the Users response, with no corresponding resource to resolve it to a name or manage its membership via API. Group name resolution, if required, must be manually mapped once via the Kommo dashboard (Settings > User Management > Group Settings) and hardcoded into the connector configuration, as it cannot be aggregated automatically.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

  1. Sign in to Kommo with an administrator account. An administrator account is required because the Roles endpoint (/api/v4/roles) is restricted to admin users only.
  2. Go to Settings > Integrations and select Create Integration.
  3. Enter a Name and Description for the integration, and set the required scopes/permissions.
  4. Select Save. Kommo generates a Client ID and Client Secret. Copy and securely store both.

  5. Complete the OAuth 2.0 authorization code flow to obtain an initial Refresh Token:

    • Direct a signed-in admin user to: https://www.kommo.com/oauth?client_id=<CLIENT_ID>&state=<STATE>&mode=post_message
    • After approval, capture the code parameter returned to your redirect URI.
    • Exchange it for tokens: POST https://{subdomain}.kommo.com/oauth2/access_token { "client_id": "<CLIENT_ID>", "client_secret": "<CLIENT_SECRET>", "grant_type": "authorization_code", "code": "<AUTH_CODE>", "redirect_uri": "<REDIRECT_URI>" }
    • Securely store the returned refresh_token - the connector uses this value going forward to mint new access tokens.

  6. Locate your subdomain (for example, vedikapatil231 in vedikapatil231.kommo.com) - required for both the Base URL and Token URL fields.

Note

  • Access tokens are short-lived; the connector must use the refresh token to obtain new access tokens as needed.
  • If an integration goes unused for 3 months, its refresh token is automatically revoked and the OAuth authorization flow must be repeated.
  • Regenerating the Client Secret immediately invalidates prior tokens tied to that integration.

Required Permissions

Who Can Generate a Client ID/Secret

Only users with administrator rights on the Kommo account can create an integration (Settings > Integrations > Create Integration). The integration is then owned by the account, and any administrator can manage its keys.

How Permissions Affect Connector Access

Access is governed by the rights of the user who authorized the OAuth connection, not solely by the integration itself:

  • If an administrator authorizes the connection, the connector has full account-wide access, including the Roles endpoint.
  • If a non-administrator user authorizes the connection, calls to /api/v4/roles return 403 Forbidden, since that endpoint is documented as administrator-only. Users and Companies/Contacts/Leads data may still be readable depending on that user's own rights.

For more information about Kommo, refer to the Kommo website, Kommo developer documentation, and Kommo API reference.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.