# Integrating SailPoint with Runrun.it

Runrun.it is a cloud-based work and project management platform that helps teams organize tasks, track time, manage capacity, and collaborate across projects and processes. It provides enterprise user management, team-based organization, role and permission controls, and a REST API for programmatic administration. This document provides the instructions required to configure a new direct connection between SailPoint and Runrun.it. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Runrun.it connector supports the following:

### Account Management

- Aggregate Users

### Entitlement Management

- Aggregate Teams

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Before configuring the Runrun.it connector, ensure you have API access on a Runrun.it account that includes the API feature. API access is a premium capability available on certain paid plans.

1. Sign in to Runrun.it with an account that has API access.
2. Go to **Integration and Apps \> API and Webhooks**.
3. Copy the **App Key** and **User Token** displayed on the page.
4. Store both values securely.
5. Record the following values for SailPoint configuration:

   - **Base URL**
   - **App Key**
   - **User Token**

> [!NOTE]
>
> Every API request is authenticated with two headers: `App-Key` (identifies the Runrun.it account) and `User-Token` (unique to a user and allows the connector to act on behalf of that user). Incorrect credentials return `401 Unauthorized`. The App Key identifies the whole account and cannot be changed through the Runrun.it GUI.

## Required Permissions

### Who Can Generate Credentials

API credentials are available from **Integration and Apps \> API and Webhooks** for accounts on plans that include API access. The **User Token** is unique to each user. For governance aggregation, use a User Token from a user with sufficient visibility into enterprise users and teams.

| Credential | Access Scope | Recommended Use |
| --- | --- | --- |
| **App Key** | Identifies the Runrun.it account for all API requests | Required for all connector operations |
| **User Token** | Acts on behalf of the user who owns the token | Determines which users are returned during account aggregation |

### User Visibility for Aggregation

The list of users returned during aggregation depends on the privileges of the User Token owner:

| Token Owner Privilege | Effect on Account Aggregation |
| --- | --- |
| **Administrator** (`Is master: true`) | Complete Aggregation |
| **Non-administrator** (`Is master: false`) | Limited Aggregation Capability |

**Recommendation:** Use an **App Key** and **User Token** from an **Administrator** account to ensure reliable aggregation of all users and teams.

## Key Implementation Notes

- Teams are the primary entitlement model exposed by this connector. Account-to-team membership is represented by the multi-valued `team_id` attribute on the user.
- `Id` is the account identity attribute, and `Name` is the account display attribute.
- Accounts are correlated to identities by matching identity `email` to account `Email`.
- Authentication requires both an **App Key** (account-level) and a **User Token** (user-level). The User Token owner's privileges determine the scope of visible users.
- API rate limits are 100 requests per minute. If the limit is reached, Runrun.it returns HTTP `429` with `RateLimit-Limit`, `RateLimit-Remaining`, and `RateLimit-Reset` headers. Wait one minute before retrying, and adjust aggregation schedules if needed.
- Responses are paginated (default and maximum page size is 100). Aggregation should follow pagination until all users and teams are retrieved.

## References

For more information, refer to the following resources:

- [Runrun.it API Documentation](<https://runrun.it/api/documentation>)
- [Runrun.it Users API](<https://runrun.it/api/documentation#users>)
- [Runrun.it Teams API](<https://runrun.it/api/documentation#teams>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.