Skip to main content

​
About Citrix Cloud

Citrix Cloud hosts Citrix DaaS (formerly Citrix Virtual Apps and Desktops service) and its supporting platform APIs. Serval calls the Citrix Cloud REST APIs on your behalf whenever a Serval workflow runs. Authentication: a Citrix Cloud service principal (Client ID and Client Secret) plus your Customer ID. Serval exchanges the service principal for a one-hour token at https://<region host>/cctrustoauth2/<customer ID>/tokens/clients and sends it on every request as Authorization: CwsAuth Bearer=<token> together with the Citrix-CustomerId header. Citrix DaaS and Monitor APIs reject the standard Bearer <token> format, so a generic OAuth connection can’t reach them. Data sync: on demand only. Serval reads from and writes to Citrix Cloud when a workflow runs.

​
What the Citrix Cloud integration enables

​
Installable workflows

The Session Self-Service bundle lets people manage their own Citrix DaaS sessions through Serval: Each workflow acts on its target user: the requester by default, or the person chosen when someone runs it on another user’s behalf. It finds that user’s Citrix account by matching their email to their UPN in Citrix Monitor, so the service principal needs to read Monitor data as well as DaaS sessions. Disconnect and log-off refuse any session that doesn’t belong to the target user. If the connection can see more than one DaaS site, the workflows stop instead of guessing which site to use.

​
Create a service principal

1

Open API Access

In Citrix Cloud, go to Identity and Access Management > API Access. Copy the Customer ID shown on this page.
2

Create the service principal

Open Service principals and create a new service principal. Give it the access your workflows need. For DaaS and Monitor, that means a Citrix DaaS administrator role (for example, a read-only role for reporting, or one with session and machine management for remediation).
3

Copy the credentials

Copy the service principal’s ID (Client ID) and Secret. Citrix shows the secret only once.
If the service principal has a network location allowlist, Citrix only issues tokens to allowed IP addresses. Contact support@serval.com for Serval’s egress IP addresses.

​
Connect in Serval

1

Choose the Region

US, EU, or Asia Pacific South (api.cloud.com) or Japan (api.citrixcloud.jp), matching the region your Citrix Cloud account is set to. Citrix Cloud Government isn’t supported.
2

Enter the Customer ID

From Identity and Access Management > API Access.
3

Enter the Client ID and Client Secret

The service principal’s ID and secret. The secret is stored encrypted and shown obfuscated when you edit the connection; leave it unchanged to keep the stored value.

​
Verifying the connection

After saving, Serval runs these health checks:
  • Test Citrix Cloud Connection: exchanges the credentials for a token and calls GET /cvad/manage/me.
  • List Citrix DaaS Delivery Groups: reads the first DaaS site from /cvad/manage/me and lists its delivery groups, confirming the service principal has a DaaS role.
  • Query Citrix Monitor Sessions: fetches one record from /monitorodata/Sessions.

​
Gotchas and troubleshooting

Most /cvad/manage endpoints require the Citrix-InstanceId header. Get the site ID from GET /cvad/manage/me (Customers[].Sites[].Id) and pass it as instanceId to the Citrix Cloud API request action. /cvad/manage/me itself doesn’t need it.
POST /cvad/manage/Sessions/{id}/$logoff returns a job. Poll GET /cvad/manage/Jobs/{id} to see when it finishes.
If the health check authenticates but DaaS or Monitor calls return “Access denied”, the service principal is missing the matching Citrix DaaS administrator role or scope.
Monitor returns at most 1,000 records per page. Follow @odata.nextLink in the response to fetch more.
Need help? Contact support@serval.com for assistance with your Citrix Cloud integration.