# Integrating SailPoint with UiPath SaaS

UiPath Automation Cloud is a cloud-based enterprise SaaS platform offered by UiPath. The SailPoint UiPath connector uses the Automation Cloud APIs to aggregate UiPath objects into SailPoint for governance and certifications.

The connector currently supports:

- UiPath groups as entitlements.
- UiPath Robot accounts as machine identities.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

### Test Connection

Validates connectivity and authentication to UiPath Identity APIs.

### Non-Human Identity Discovery

Aggregates UiPath Robot accounts as machine identities through dataset aggregation.

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

### Entitlement Aggregation

Aggregates UiPath groups as entitlements.

> [!NOTE]
>
> There are no provisioning operations in this connector.

## Prerequisites

This section describes the information you need to configure a connection.

### Organization ID (partitionGlobalId)

It uniquely identifies the organization you're managing. You can locate your `partitionGlobalId` in the URL when you are signed in to the portal.

For example, in the URL: `https://baseURL/tenant/portal_/cloudrpa?organizationId=xxxxxx&ecommerceRedirect=false&isAuth0=true`, `partitionGlobalId` is `xxxxxx`.

### Personal Access Token (PAT)

If you are using Personal Access Token (PAT) as Authentication, you must create a token.

Creating a Personal Access Token:

1. Sign in to the UiPath console.
2. Select the user icon in the top-right corner of the window.
3. Select **Preferences**.
4. Select **Personal Access Tokens** from the left-hand menu.
5. Select **Generate new token**. Set the appropriate permissions (Scopes) for your token mentioned in [Required Permissions](<#required-permissions>).

   > **Note**
   >
   > Maximum expiry 360 days.

### Client ID and Client Secret

If you are using OAuth 2.0 as Authentication, you must register a new application to generate a Client ID and Client Secret.

1. Go to **Admin \> External Applications \> OAuth apps**.
2. Add the application with appropriate permissions (Scopes) for your token mentioned in [Required Permissions](<#required-permissions>).
3. After the application is created, copy the **App ID** and the **App Secret**.

   - Use the **App ID** as the **Client ID** for the connector configuration.
   - Use the **App Secret** as the **Client Secret** for the connector configuration.

> [!IMPORTANT]
>
> Resources Links
>
> - [Retrieving partitionGlobalId for API use](<https://docs.uipath.com/automation-cloud/automation-cloud/latest/api-guide/retrieving-partitionglobalid-for-api-use>)
> - [Personal Access Tokens](<https://docs.uipath.com/automation-cloud/automation-cloud/latest/api-guide/personal-access-tokens>)
> - [External Applications (OAuth)](<https://docs.uipath.com/automation-cloud/automation-cloud/latest/api-guide/accessing-uipath-resources-using-external-applications>)

## Required Permissions

While creating the Personal Access Token (PAT) or OAuth application, select **Platform Management API Access** as the resource.

### Scope-based access (Recommended)

To perform all required actions, select the following scopes:

- `PM.RobotAccount.Read`
- `PM.Group.Read`

### Permission-level access

If you configure access at a granular permission level, ensure Read permissions are granted for:

- Robot Account APIs
- Group APIs