# SailPoint Qdrant Connector Documentation

> Qdrant Connector Documentation

# Documentation

# Connecting SailPoint and Qdrant

To connect SailPoint to the source, perform the following tasks:

## Adding and Configuring the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

1. Go to **Admin \> Connections \> Sources**.
2. Select **Create New**.
3. Search for a source type and select **Actions**.
4. In the **Actions** dropdown, select the setup method:

   - **Express Setup** - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - **Standard Setup** - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Express Setup

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated source name, source owner, and description. To update, select **Edit**.

   > **Note**
   >
   > Source name must be unique.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** page.
5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Standard Setup

Configure more detailed settings relative to Express Setup.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Here, continue to configure your connected source.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a descriptive **Source Name** for the connection.
2. Enter the **Source Description** that provides details necessary to distinguish it from similar connection sources.
3. In **Source Owner**, begin typing the name of the source owner.
4. (Optional) Select the appropriate **Governance Group for Source Management** from the dropdown list. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
5. Select **Create Manual Work Items** to enable the source to support additional source management features such as creating accounts and access profile management.

   > **Important**
   >
   > Once you enable this feature, it can't be disabled.

   For more information on manual work items, refer to [Work Items](<https://developer.sailpoint.com/docs/api/work-items>). For more information on SailPoint features, refer to [SailPoint Identity Services](<https://documentation.sailpoint.com/saas/help/index.html>).
6. Select **Save**.

## Connection Settings

Configure a secured, direct connection to the source.

1. Enter the Qdrant Cloud REST endpoint as **Base URL**. For example, `https://api.cloud.qdrant.io`.
2. Enter the UUID of the Cloud account as **Account ID**. This value must appear in every operation URL as `/accounts/{account_id}/...`.
3. Enter the Cloud Management Key as **API Token**. The connector sends `Authorization: apikey <YOUR_CLOUD_MANAGEMENT_KEY>`.
4. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Integrating SailPoint with Qdrant

Qdrant Cloud is a managed vector database platform used to run, scale, and operate Qdrant clusters. In addition to cluster and backup management, the Cloud control plane provides Identity and Access Management (IAM) for the organization: members (users), roles, and permissions that control who can manage accounts, clusters, API keys, billing, and other Cloud resources. This document provides the instructions required to configure a new direct connection between SailPoint and Qdrant for Quick Compliance use cases. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Qdrant connector supports the following:

### Account Management

- Aggregate Accounts

### Entitlement Management

- Aggregate Roles

### Pagination

The IAM list endpoints used by this source (`ListUsers`, `ListRoles`, `ListUserRoles`) return the full collection in a single JSON envelope (`items` or `roles`). They do not expose skip/limit or cursor fields in the current public API. Leave paging disabled on these HTTP operations unless Qdrant later adds paging parameters to the same paths.

> [!NOTE]
>
> This connector is read-only. It supports test connection, account aggregation, and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported.

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before you configure the Qdrant connector, ensure the following requirements are met:

1. Sign in to [Qdrant Cloud](<https://cloud.qdrant.io/>).
2. Note your Account ID. This is a 36-character UUID. It appears in the Cloud console URL and in every Cloud API path as `{account_id}`.
3. Go to **Access Management \> Cloud Management Keys** and create a Cloud Management Key with at least `read:users` and `read:roles` (see Required Permissions).

   - **Base URL**
   - **Account ID** - the 36-character UUID of the Qdrant Cloud account to govern
   - **API Token** - Cloud Management Key, sent as `Authorization: apikey <key>`
4. Store the token so the `apikey` prefix is present on every request. Either:

   - Save the full header value in the source token field (`apikey <keyId>|<secret>`), or
   - Save only the key and hardcode `apikey` in the HTTP operation header template.

For more detailed information, refer to the [official Qdrant Cloud API documentation](<https://qdrant.tech/documentation/cloud-api/>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

The Cloud Management Key inherits the permissions of the creating user or assigned role. Aggregation is read-only and requires:

- **read:users** - list account members (`ListUsers` / members).
- **read:roles** - list roles (`ListRoles`) and list a user's assigned roles (`ListUserRoles`).
- **read:account** - recommended so connection tests against account-scoped endpoints succeed.

Built-in system roles on a Qdrant Cloud account typically include:

- **Owner** (`SYSTEM_ROLE_SUB_TYPE_OWNER`) - full account administration, including `delete:account`.
- **Admin** (`SYSTEM_ROLE_SUB_TYPE_ADMIN`) - manage clusters, IAM, keys, and most write operations except deleting the account.
- **Base** (`SYSTEM_ROLE_SUB_TYPE_BASE`) - limited profile or account read (`read:profile`, `read:account`).

Use a key created by an Owner or Admin (or a custom role that includes the read permissions above). A Base-only identity cannot enumerate users or roles.

## HTTP Operations

Configure three operations on the Web Services SaaS source. Replace `{account_id}` with the real 36-character UUID (or `$application.accountId$` only after that attribute exists on the source).

### List Members (Account Aggregation)

- **Operation Type:** Account Aggregation
- **Request:**

```text
curl --location --request GET 'https://api.cloud.qdrant.io/api/iam/v1/accounts/{account_id}/users' \
--header 'Authorization: $application.accesstoken$'
```

- **Root Path:** `$.items`
- **Response mapping:**

| Schema Attribute | Attribute Path |
| --- | --- |
| id | $.id |
| email | $.email |
| status | $.status |
| createdAt | $.createdAt |
| lastModifiedAt | $.lastModifiedAt |

### Get User Roles (Account Aggregation - Child)

- **Operation Type:** Account Aggregation (child of List Members)
- **Request:**

```text
curl --location --request GET 'https://api.cloud.qdrant.io/api/iam/v1/accounts/{account_id}/users/$response.id$/roles' \
--header 'Authorization: $application.accesstoken$'
```

- **Root Path:** `$.roles` - not `$.items`. `ListUserRoles` returns `{ "roles": [ … ] }`. Using `$.items` aggregates accounts with empty entitlements and no error.
- **Response mapping** (account schema only; map attributes that exist on the account):

| Schema Attribute | Attribute Path |
| --- | --- |
| role\_id | $.id |

### List All Roles (Group Aggregation - Role)

- **Operation Type:** Group Aggregation-Role (Entitlement Aggregation for object type Role)
- **Request:**

```text
curl --location --request GET 'https://api.cloud.qdrant.io/api/iam/v1/accounts/{account_id}/roles' \
--header 'Authorization: $application.accesstoken$'
```

- **Root Path:** `$.items` - `ListRoles` returns `{ "items": [ … ] }`.
- **Response mapping** (must match the Role entitlement schema attribute names):

| Schema Attribute | Attribute Path |
| --- | --- |
| role\_id | $.id |
| name | $.name |
| roleType | $.roleType |

The Role schema's Entitlement ID must be `role_id`.

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The Qdrant connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| id | Account |

### Default Account Attributes

The Qdrant connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| id | Unique ID of the member |
| email | Email of the member |
| status | Status of the member |
| createdAt | Timestamp when the member was created |
| lastModifiedAt | Timestamp when the member was last modified |
| role\_id | ID(s) of the Role(s) assigned to the member |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Role Attributes

The Qdrant connector supports roles. The following attributes must be configured on the managed system and in the SailPoint source schema to manage roles.

| Attribute Name | Description |
| --- | --- |
| role\_id | Unique ID of the role |
| name | Name of the role |
| roleType | Type of the role |