Skip to content

Integrating SailPoint with Pipefy

Pipefy is a cloud workflow and process management platform used to manage organizations, members, roles, pipes, and related operational work. This document provides the instructions required to configure a new direct connection between SailPoint and Pipefy for Quick Compliance use cases. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Pipefy connector supports the following:

Account Management

  • Aggregate Organization Members

Entitlement Management

  • Aggregate Organization Roles

Note

This connector is read-only. It supports account aggregation and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported in this release.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before configuring the Pipefy connector, create a Service Account in Pipefy. You must be a Super Admin in the organization to complete these steps.

  1. Sign in to the Pipefy application.
  2. Select the name of your company or your profile image at the top of the page, then select Members and Permissions.
  3. Open the Service Accounts tab and select Create Service Account.
  4. Enter an Account Name (up to 20 characters). This value is used to create the service account email. Optionally add a description (up to 140 characters).
  5. Assign an organization role that can access the members list. Use Super Admin or Admin. Members, company guests, and external guests cannot access the members menu.
  6. Set the token expiration. The minimum is 5 minutes and the maximum is 30 days. This value cannot be changed after the service account is created. Create a new service account if a different expiration is required.
  7. Open the new service account and copy the Client ID, Client Secret, and token endpoint. Treat these values as sensitive credentials.
  8. Record the Organization ID. Open the organization home page and copy the numeric ID from the URL, for example https://app.pipefy.com/organizations/123456789. The Organization ID is the number after /organizations/.
  9. Record the following values for SailPoint configuration:
    • Base URL (https://api.pipefy.com/graphql)
    • Token URL (https://app.pipefy.com/oauth/token)
    • Client ID
    • Client Secret
    • Organization ID

Note

Store the Client Secret securely. Pipefy Service Accounts use the Client Credentials grant to generate a Bearer token. As long as the current token is valid, Pipefy returns the same token and issues a new one only after it expires.

Required Permissions

Role-Based Access

This connector authenticates with a Pipefy Service Account. The permissions available to SailPoint are the permissions granted by the organization role assigned to that service account.

Creating a Service Account requires a Super Admin. For aggregation, the service account must be able to read organization members and roles through the GraphQL API.

In Pipefy, predefined company / organization roles are:

  • Super Admin (super_admin) - full administrative access, including members and permissions
  • Admin (admin) - administrative access, including the members menu
  • Member (normal) - standard user access; cannot access the members menu
  • Company guest (company_guest) - limited access for company members
  • External guest (external_guest) - limited access for external users

Paid plans (Business, Enterprise, and Unlimited) can also include custom roles. Freemium organizations typically expose only admin and super_admin.

Pipefy company-level permissions relevant to this connector:

Permission Super admin Admin Member Company guest External guest
Access the members' menu Yes Yes No No No
Invite people Yes Yes No No No
Remove people Yes Yes No No No
Access the admin dashboard Yes Yes No No No

Recommendation: Create a dedicated Service Account with the Super Admin or Admin role. Pipe-level and database-level permissions are not required for this connector.

Key Implementation Notes

  • Uses OAuth 2.0 Client Credentials with a Pipefy Service Account. Personal Access Tokens are deprecated and not used.
  • Creating a Service Account requires a Pipefy Super Admin. Assign the service account the Super Admin or Admin role to allow access to the members list.
  • Set token expiration when creating the Service Account (5 minutes to 30 days); it cannot be changed later.
  • The Organization ID is the numeric ID from https://app.pipefy.com/organizations/{id}, not the organization UUID.
  • Accounts use UUID as the identity attribute, Name as the display attribute, and Email as the correlation attribute.
  • Aggregate role entitlements from organization roles, including predefined and custom roles on paid plans.
  • This read-only release supports Quick Compliance only. Pipefy pipes, databases, cards, and write operations are not aggregated or provisioned.

References

For more information, refer to the following resources:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.