# Integrating SailPoint with Pipefy Pipefy is a cloud workflow and process management platform used to manage organizations, members, roles, pipes, and related operational work. This document provides the instructions required to configure a new direct connection between SailPoint and Pipefy for Quick Compliance use cases. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](). > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Pipefy connector supports the following: ### Account Management - Aggregate Organization Members ### Entitlement Management - Aggregate Organization Roles > [!NOTE] > > This connector is read-only. It supports account aggregation and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported in this release. > [!IMPORTANT] > > Quick Compliance connectors have the following manual aggregation limits within a 24-hour period: > > - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization. > - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source. > > These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support. ## Prerequisites Before configuring the Pipefy connector, create a Service Account in Pipefy. You must be a **Super Admin** in the organization to complete these steps. 1. Sign in to the Pipefy application. 2. Select the **name of your company** or your **profile image** at the top of the page, then select **Members and Permissions**. 3. Open the **Service Accounts** tab and select **Create Service Account**. 4. Enter an **Account Name** (up to 20 characters). This value is used to create the service account email. Optionally add a description (up to 140 characters). 5. Assign an organization role that can access the members list. Use **Super Admin** or **Admin**. Members, company guests, and external guests cannot access the members menu. 6. Set the token expiration. The minimum is 5 minutes and the maximum is 30 days. This value cannot be changed after the service account is created. Create a new service account if a different expiration is required. 7. Open the new service account and copy the **Client ID**, **Client Secret**, and **token endpoint**. Treat these values as sensitive credentials. 8. Record the **Organization ID**. Open the organization home page and copy the numeric ID from the URL, for example `https://app.pipefy.com/organizations/123456789`. The Organization ID is the number after `/organizations/`. 9. Record the following values for SailPoint configuration: - **Base URL** (`https://api.pipefy.com/graphql`) - **Token URL** (`https://app.pipefy.com/oauth/token`) - **Client ID** - **Client Secret** - **Organization ID** > [!NOTE] > > Store the Client Secret securely. Pipefy Service Accounts use the Client Credentials grant to generate a Bearer token. As long as the current token is valid, Pipefy returns the same token and issues a new one only after it expires. ## Required Permissions ### Role-Based Access This connector authenticates with a Pipefy Service Account. The permissions available to SailPoint are the permissions granted by the **organization role** assigned to that service account. Creating a Service Account requires a **Super Admin**. For aggregation, the service account must be able to read organization members and roles through the GraphQL API. In Pipefy, predefined company / organization roles are: - **Super Admin** (`super_admin`) - full administrative access, including members and permissions - **Admin** (`admin`) - administrative access, including the members menu - **Member** (`normal`) - standard user access; cannot access the members menu - **Company guest** (`company_guest`) - limited access for company members - **External guest** (`external_guest`) - limited access for external users Paid plans (Business, Enterprise, and Unlimited) can also include custom roles. Freemium organizations typically expose only `admin` and `super_admin`. Pipefy company-level permissions relevant to this connector: | Permission | Super admin | Admin | Member | Company guest | External guest | | --- | --- | --- | --- | --- | --- | | Access the members' menu | Yes | Yes | No | No | No | | Invite people | Yes | Yes | No | No | No | | Remove people | Yes | Yes | No | No | No | | Access the admin dashboard | Yes | Yes | No | No | No | **Recommendation:** Create a dedicated Service Account with the **Super Admin** or **Admin** role. Pipe-level and database-level permissions are not required for this connector. ## Key Implementation Notes - Uses **OAuth 2.0 Client Credentials** with a Pipefy **Service Account**. Personal Access Tokens are deprecated and not used. - Creating a Service Account requires a Pipefy **Super Admin**. Assign the service account the **Super Admin** or **Admin** role to allow access to the members list. - Set token expiration when creating the Service Account (5 minutes to 30 days); it cannot be changed later. - The **Organization ID** is the numeric ID from `https://app.pipefy.com/organizations/{id}`, not the organization UUID. - Accounts use `UUID` as the identity attribute, `Name` as the display attribute, and `Email` as the correlation attribute. - Aggregate role entitlements from organization roles, including predefined and custom roles on paid plans. - This read-only release supports Quick Compliance only. Pipefy pipes, databases, cards, and write operations are not aggregated or provisioned. ## References For more information, refer to the following resources: - [Pipefy GraphQL API reference]() - [Pipefy Service Accounts]() - [Pipefy authentication]() > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice.