Skip to content

Integrating SailPoint with Nifty

Nifty is a project management and collaboration platform where teams plan work in projects, group those projects into portfolios, and manage who has access to each. It combines tasks, milestones, docs, and discussions in one workspace. This document provides the instructions required to configure a new direct connection between SailPoint and Nifty for Quick Compliance use cases. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Nifty connector supports the following:

Account Management

  • Aggregate Members

Entitlement Management

  • Aggregate Portfolios
  • Aggregate Projects

Note

This connector is read-only. It supports account and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported in this release.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before you configure the Nifty connector, ensure the following requirements are met:

  1. The Nifty workspace must be on the Business plan or above. The Nifty API is not available on lower plans.
  2. Sign in to Nifty with an account that has Owner or Admin rights on the workspace. Administrator rights are required so the generated token can read all members, portfolios, and projects rather than only those the user personally belongs to.
  3. Use a dedicated integration account rather than a named individual's login. A Nifty API token is bound to the member who created it, so the source stops aggregating if that member is removed from the workspace. Create a workspace member on a shared, non-personal address (for example sailpoint-integration@yourcompany.com), grant it Admin or Owner role, and generate the token while signed in as that account.
  4. Go to Settings > App Center > API Tokens and create a new API token.
  5. Select the Full access scope tier. The Nifty v1.0 API has no per-action scope model and rejects any token with a narrower scope, returning 403 Forbidden on every endpoint.
  6. Copy and securely store the token when it is displayed. The token is shown only once at creation time and cannot be retrieved afterwards. It has the form nft_user_<prefix>_<secret>.
  7. Record the following values for connector configuration:
    • Base URL
    • API Token

Note

  • The API token is presented as a bearer credential on every request. There is no token exchange or refresh step; the connector sends the stored token directly.
  • OAuth 2.1 is not supported by this connector. Nifty's v1.0 API accepts only tokens carrying the admin (Full access) scope tier, and Nifty's OAuth 2.1 authorization server does not issue that tier. OAuth access tokens are therefore rejected with 403 Forbidden. Nifty's OAuth refresh tokens additionally rotate on every use and expire after 7 days, with replay of a consumed token revoking the entire token family.
  • If the integration account is removed from the workspace, or its token is revoked or regenerated, update the connector's stored credential before the next aggregation or authentication will begin failing.

Required Permissions

Any workspace member can create an API token, but the token inherits that member's permissions. Only an Owner or Admin has visibility across all portfolios and projects in the workspace.

Access is governed by two independent factors - the scope tier chosen at token creation, and the role of the member who created it:

  • Scope tier - Only Full access works against the v1.0 API. A token created with a narrower tier fails authentication entirely, not merely on individual endpoints.
  • Member role - A token created by a regular member returns only the portfolios and projects that member belongs to. Aggregation appears to succeed but silently returns partial data, which SailPoint interprets as those accounts having no access.

Key behaviors to account for:

  • A Full-access token created by a non-admin produces incomplete entitlement data rather than an authorization error.
  • Removing the token's owning member from the workspace invalidates the token and breaks the source.
  • The connector aborts account aggregation if no portfolio or project membership can be read at all, rather than reporting every account as having lost access.

For more information about Nifty, refer to the following:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.