Skip to main content

​
About ConductorOne

ConductorOne (now branded C1) is an identity governance and access management (IGA) platform for access reviews, entitlements, provisioning, and access requests. The Serval integration connects to your company’s ConductorOne tenant using an API key you create in ConductorOne, and gives Serval workflows access to the full ConductorOne API - apps, entitlements, request catalogs, users, policies, grant and revoke tasks, and search. Serval stores your credentials encrypted and only ever sends them to hosts under conductor.one. Authentication: OAuth 2.0 client credentials, using a ConductorOne API key (Client ID and Client Secret) plus your tenant domain. Serval exchanges these for access tokens directly against your tenant. Data sync: On-demand only. Serval does not import or continuously sync ConductorOne data in the background. Workflows call the ConductorOne API live when they run, and built-in health checks verify the connection.

​
What the ConductorOne integration enables

Anything defined in the ConductorOne API can be accessed through Serval.

​
Get your credentials

You will create one API credential in ConductorOne, which gives you a Client ID and a Client Secret. Together with your Tenant Domain, these are the three values Serval needs. ConductorOne’s own guide is here: how to authenticate API requests.
1

Open the API settings in ConductorOne

In the ConductorOne web app, click your username at the bottom of the screen and select AI & API.
2

Create a credential

In the API credentials section, click Create credential.
3

Configure the key

Give it a descriptive name (for example, “Serval Integration”), set the key’s lifespan (30 days, 90 days, or never expires), optionally restrict the source IPs in the Allowed IPs field, and select the scope of permissions. Choose Full Permissions, or select specific roles to limit what the key can do.
4

Copy both values

Click Create, then copy the Client ID and the Client Secret.
5

Find your Tenant Domain

Your Tenant Domain is the hostname inside your Client ID. The Client ID follows the format random-id@hostname/use-case - for example, for strange-hydra-68836@acme.conductor.one/pcc, the Tenant Domain is acme.conductor.one.
The Client Secret is shown only once, at creation. Copy it before leaving the page. If you lose it, you will need to create a new credential.
If you set a lifespan on the key (30 or 90 days), set a reminder to rotate it before it expires - an expired key makes every Serval health check fail.

​
Connect in Serval

1

Add the ConductorOne integration

Add a new ConductorOne connection from your Serval integrations page.
2

Enter your Tenant Domain

Tenant Domain (required). Enter the full hostname, matching the field’s placeholder your-company.conductor.one. The helper text reads “Your ConductorOne tenant domain (e.g., your-company.conductor.one)”. Leaving it blank shows “This field is required”. Serval does not check the format here - a wrong value is accepted at save time and only surfaces later as failing health checks, so double-check it against the hostname in your Client ID.
3

Enter your Client ID

Client ID (required). Paste the full Client ID exactly as ConductorOne shows it, including everything after the @. Helper text: “Your ConductorOne API Client ID”. Leaving it blank shows “This field is required”.
4

Enter your Client Secret

Client Secret (required, hidden as you type). Paste the secret you copied at creation. Helper text: “Your ConductorOne API Client Secret”.
5

Submit and verify

Click Submit. If installation fails, the form shows “Failed to install integration” (with details appended when available). On success the connection appears as “ConductorOne”. Serval does not test the credentials when you save, so run the health checks below right after connecting.
When you later edit this connection, every save must include all three values in full. Tenant Domain and Client ID come pre-filled with their saved values - keep them complete and correct. The Client Secret appears masked (bullet characters plus its last 4 characters); click Replace (or the pencil icon) and paste the complete secret before saving, even if you only meant to change another field - this connection does not keep the previously stored secret when the field is left masked or blank. If an update fails, Serval shows “Failed to update integration:” followed by details, “Failed to update configuration”, or “Failed to save configuration. Please try again.”, depending on which form you used.

​
Verifying the connection

The ConductorOne integration runs three health checks against your live tenant:
The connection test and the users check call the same part of the API, so the usual partial failure is the first two checks passing while “List ConductorOne Apps” fails. That means your credentials are valid but the API key’s scope cannot read apps. Recreate the credential in ConductorOne with a broader scope (for example, Full Permissions) and update the connection in Serval.

​
Gotchas and troubleshooting

Enter the complete hostname, like your-company.conductor.one - not just your-company, and not a URL starting with https://. Serval uses the value exactly as you type it and does not validate the format when you save, so a malformed value is accepted silently and then fails every health check. Serval also only attaches your credentials to requests sent to hosts under conductor.one, so a value outside that domain can never work. The reliable way to find the right value: it is the hostname inside your Client ID, between the @ and the /.
The ConductorOne API key carries its permissions in the scope you chose when creating it - there is nothing to adjust on the Serval side. If the connection authenticates but cannot list apps (or users), the key’s scope lacks read permissions. Create a new credential in ConductorOne with a broader scope (such as Full Permissions) and update the Serval connection with the new values.
The edit form pre-fills Tenant Domain and Client ID with their saved values and shows the Client Secret masked, with a Replace button (or a pencil icon, depending on where you edit). Before saving any change - even one to a different field - click Replace and paste the complete Client Secret into the “Enter new value” box. This connection does not preserve the stored secret when the field is left masked or blank, so saving without re-entering it breaks the connection. Keep Tenant Domain and Client ID complete and correct as well, and re-run the health checks after any edit to confirm the connection still works.
ConductorOne displays the Client Secret a single time, at creation. If it was lost, there is no way to view it again - create a new API credential in ConductorOne, then edit the Serval connection, click Replace on the Client Secret, and re-enter all three fields with the new values. See ConductorOne’s guide to authenticating API requests.
Need help? Contact support@serval.com for assistance with your ConductorOne integration.