Skip to content

Integrating SailPoint with OpenRouter

OpenRouter is a platform for calling language models through one API. An OpenRouter organization is the company account where members, workspaces, API keys, and provider credentials are managed. People who belong to that organization are members. Those members are the accounts this connector aggregates. This document covers how to configure a new direct connection between SailPoint and OpenRouter for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The OpenRouter connector supports the following:

Account Management

  • Aggregate Users (organization members)

Entitlement Management

  • Aggregate Workspaces

Note

The organization role (org:admin or org:member) is collected on the account. There is no separate role catalog to aggregate.

Non-Human Identity Discovery

  • Aggregate API Keys
  • Aggregate Credential Providers

Note

API keys and credential providers are aggregated as non-human identity resources through Dataset Management. They stay out of user account aggregation. These resources do not define owner correlation. The list responses do not include secret values, and the connector does not store them.

Note

This connector is read-only. It supports test connection, account aggregation, entitlement aggregation, and dataset aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before you configure the OpenRouter connector, ensure the following requirements are met:

  1. Sign in to OpenRouter as an organization administrator. A management key for an organization can only be created by an organization admin. A personal account that does not belong to an organization cannot be aggregated.
  2. Open the Management API Keys page.
  3. Select Create New Key.
  4. Enter a name and choose an expiration. The expiration is fixed when the key is created. Set a new key before this one expires.
  5. Copy the key when it is shown. OpenRouter does not show it again.

  6. Record the following values for connector configuration:

    • Base URL
    • OpenRouter management key

For more information, refer to the OpenRouter Management API Keys documentation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

The management key must be allowed to call the organization, workspace, API key, and credential provider list operations. With a valid management key, the connector can:

  • List organization members, including email, name, and organization role
  • List workspaces and the members of each workspace
  • List API keys in each workspace, including disabled and expired keys
  • List credential providers in each workspace