Skip to content

Integrating SailPoint with LangChain

LangChain is a platform for building, tracing, evaluating, and deploying LLM applications. An organization is the tenant for members, billing, and SSO/SCIM. Work happens in workspaces under that organization. People who sign in, or who are provisioned by SCIM, are organization members - the Platform users this connector aggregates. Each member has one organization role and zero or more workspace memberships, each with one workspace role. Fine-grained permissions such as projects:read sit on the role, not on the user. The LangChain connector calls the LangSmith Platform REST API at https://api.smith.langchain.com to list members, workspaces, and roles. This document covers how to configure a new direct connection between SailPoint and LangChain for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The LangChain connector supports the following:

Account Management

  • Aggregate Users

Entitlement Management

  • Aggregate Roles
  • Aggregate Workspaces

Note

This connector is read-only. It supports test connection, account aggregation, and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before you configure the LangChain connector, ensure the following requirements are met:

  1. Sign in to LangChain.
  2. Go to Settings > API Keys and select + API Key.

  3. In the Create an API Key dialog:

    • Description - enter a name that identifies the integration, for example SailPoint.
    • Key Type - select Personal Access Token. A PAT authenticates as an individual user and inherits that user's permissions, so the signed-in user must hold the Organization Admin role for the key to read all members, workspaces, and roles.
    • Default Workspace - Default Workspace is used only when no X-Tenant-ID header is sent. It does not limit aggregation.
    • Expiration Date - choose Never. The key remains valid until it is revoked. If the key is revoked, requests fail with 401; create a new PAT and update API Token.

  4. Select Create API Key and copy it immediately. LangChain displays the key only once.

  5. Record the following values for connector configuration:

    • Base URL
    • API Token

Note

  • The connector authenticates with the PAT sent in the X-API-Key header. The organization is implied by the key; you do not configure an Organization ID on the source.
  • All API requests must use HTTPS. Unencrypted HTTP calls are not supported and will fail.
  • Credentials should be stored securely and treated like a password.

Required Permissions

The connector authenticates with a Personal Access Token. The user who generates the PAT must hold Organization Admin, so that the token can:

  • List organization members
  • List organization roles
  • List workspaces

For more detailed information on LangChain API authentication, refer to the official LangChain documentation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.