> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ConductorOne

> Connect ConductorOne (C1) to Serval to automate identity governance work - access reviews, entitlements, access requests, and grant/revoke tasks - through the full ConductorOne API.

## About ConductorOne

ConductorOne (now branded C1) is an identity governance and access management (IGA) platform for access reviews, entitlements, provisioning, and access requests. The Serval integration connects to your company's ConductorOne tenant using an API key you create in ConductorOne, and gives Serval workflows access to the full ConductorOne API - apps, entitlements, request catalogs, users, policies, grant and revoke tasks, and search. Serval stores your credentials encrypted and only ever sends them to hosts under conductor.one.

**Authentication:** OAuth 2.0 client credentials, using a ConductorOne API key (Client ID and Client Secret) plus your tenant domain. Serval exchanges these for access tokens directly against your tenant.

**Data sync:** On-demand only. Serval does not import or continuously sync ConductorOne data in the background. Workflows call the ConductorOne API live when they run, and built-in health checks verify the connection.

## What the ConductorOne integration enables

| Capability                     | Description                                                                                                                                                                                                                                                                                              |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Full API access from workflows | Workflows use the "ConductorOne API request" action to call any part of the ConductorOne API - 163 endpoints (243 operations) covering apps, app entitlements and entitlement owners, request catalogs, users, policies, grant and revoke tasks, and search across apps, entitlements, users, and tasks. |
| Connection health checks       | Three built-in checks run against your live tenant to confirm Serval can authenticate and has permission to read users and apps.                                                                                                                                                                         |
| AI-assisted workflow authoring | Serval's AI knows the full ConductorOne API surface, so it can help you build ConductorOne workflows without you needing to look up API details.                                                                                                                                                         |

Anything defined in the [ConductorOne API](https://www.c1.ai/docs/conductorone-api/api) can be accessed through Serval.

## Get your credentials

You will create one API credential in ConductorOne, which gives you a Client ID and a Client Secret. Together with your Tenant Domain, these are the three values Serval needs. ConductorOne's own guide is here: [how to authenticate API requests](https://www.c1.ai/docs/conductorone-api/authenticate).

<Steps>
  <Step title="Open the API settings in ConductorOne">
    In the ConductorOne web app, click your username at the bottom of the screen and select **AI & API**.
  </Step>

  <Step title="Create a credential">
    In the **API credentials** section, click **Create credential**.
  </Step>

  <Step title="Configure the key">
    Give it a descriptive name (for example, "Serval Integration"), set the key's lifespan (30 days, 90 days, or never expires), optionally restrict the source IPs in the **Allowed IPs** field, and select the scope of permissions. Choose **Full Permissions**, or select specific roles to limit what the key can do.
  </Step>

  <Step title="Copy both values">
    Click **Create**, then copy the **Client ID** and the **Client Secret**.
  </Step>

  <Step title="Find your Tenant Domain">
    Your Tenant Domain is the hostname inside your Client ID. The Client ID follows the format random-id\@hostname/use-case - for example, for [strange-hydra-68836@acme.conductor.one](mailto:strange-hydra-68836@acme.conductor.one)/pcc, the Tenant Domain is acme.conductor.one.
  </Step>
</Steps>

<Warning>
  The Client Secret is shown only once, at creation. Copy it before leaving the page. If you lose it, you will need to create a new credential.
</Warning>

<Tip>
  If you set a lifespan on the key (30 or 90 days), set a reminder to rotate it before it expires - an expired key makes every Serval health check fail.
</Tip>

## Connect in Serval

<Steps>
  <Step title="Add the ConductorOne integration">
    Add a new **ConductorOne** connection from your Serval integrations page.
  </Step>

  <Step title="Enter your Tenant Domain">
    **Tenant Domain** (required). Enter the full hostname, matching the field's placeholder your-company.conductor.one. The helper text reads "Your ConductorOne tenant domain (e.g., your-company.conductor.one)". Leaving it blank shows "This field is required". Serval does not check the format here - a wrong value is accepted at save time and only surfaces later as failing health checks, so double-check it against the hostname in your Client ID.
  </Step>

  <Step title="Enter your Client ID">
    **Client ID** (required). Paste the full Client ID exactly as ConductorOne shows it, including everything after the @. Helper text: "Your ConductorOne API Client ID". Leaving it blank shows "This field is required".
  </Step>

  <Step title="Enter your Client Secret">
    **Client Secret** (required, hidden as you type). Paste the secret you copied at creation. Helper text: "Your ConductorOne API Client Secret".
  </Step>

  <Step title="Submit and verify">
    Click **Submit**. If installation fails, the form shows "Failed to install integration" (with details appended when available). On success the connection appears as "ConductorOne". Serval does not test the credentials when you save, so run the health checks below right after connecting.
  </Step>
</Steps>

<Warning>
  When you later edit this connection, every save must include all three values in full. **Tenant Domain** and **Client ID** come pre-filled with their saved values - keep them complete and correct. The **Client Secret** appears masked (bullet characters plus its last 4 characters); click **Replace** (or the pencil icon) and paste the complete secret before saving, even if you only meant to change another field - this connection does not keep the previously stored secret when the field is left masked or blank. If an update fails, Serval shows "Failed to update integration:" followed by details, "Failed to update configuration", or "Failed to save configuration. Please try again.", depending on which form you used.
</Warning>

## Verifying the connection

The ConductorOne integration runs three health checks against your live tenant:

| Health check                 | What it does                                                                         | On success                                                             | On failure                                                                                                  |
| ---------------------------- | ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| Test ConductorOne Connection | Confirms Serval can authenticate with your tenant by making a minimal users request. | "Successfully authenticated with ConductorOne"                         | "Unable to connect to ConductorOne. Please verify your Client ID and Client Secret are valid."              |
| List ConductorOne Users      | Confirms the key can read users by fetching a small sample (up to 10).               | "Successfully listed users from ConductorOne (sample size: \[number])" | "Unable to list users from ConductorOne. Please verify the API credentials have the necessary permissions." |
| List ConductorOne Apps       | Confirms the key can read apps by fetching a small sample (up to 10).                | "Successfully listed apps from ConductorOne (sample size: \[number])"  | "Unable to list apps from ConductorOne. Please verify the API credentials have the necessary permissions."  |

<Tip>
  The connection test and the users check call the same part of the API, so the usual partial failure is the first two checks passing while "List ConductorOne Apps" fails. That means your credentials are valid but the API key's scope cannot read apps. Recreate the credential in ConductorOne with a broader scope (for example, Full Permissions) and update the connection in Serval.
</Tip>

## Gotchas and troubleshooting

<AccordionGroup>
  <Accordion title="Tenant Domain must be the full hostname, not a company name or URL">
    Enter the complete hostname, like your-company.conductor.one - not just your-company, and not a URL starting with https\://. Serval uses the value exactly as you type it and does not validate the format when you save, so a malformed value is accepted silently and then fails every health check. Serval also only attaches your credentials to requests sent to hosts under conductor.one, so a value outside that domain can never work. The reliable way to find the right value: it is the hostname inside your Client ID, between the @ and the /.
  </Accordion>

  <Accordion title="Authentication passes but the apps check fails">
    The ConductorOne API key carries its permissions in the scope you chose when creating it - there is nothing to adjust on the Serval side. If the connection authenticates but cannot list apps (or users), the key's scope lacks read permissions. Create a new credential in ConductorOne with a broader scope (such as Full Permissions) and update the Serval connection with the new values.
  </Accordion>

  <Accordion title="Editing the connection: always re-enter the Client Secret">
    The edit form pre-fills **Tenant Domain** and **Client ID** with their saved values and shows the **Client Secret** masked, with a **Replace** button (or a pencil icon, depending on where you edit). Before saving any change - even one to a different field - click **Replace** and paste the complete Client Secret into the "Enter new value" box. This connection does not preserve the stored secret when the field is left masked or blank, so saving without re-entering it breaks the connection. Keep Tenant Domain and Client ID complete and correct as well, and re-run the health checks after any edit to confirm the connection still works.
  </Accordion>

  <Accordion title="The Client Secret is only shown once in ConductorOne">
    ConductorOne displays the Client Secret a single time, at creation. If it was lost, there is no way to view it again - create a new API credential in ConductorOne, then edit the Serval connection, click **Replace** on the Client Secret, and re-enter all three fields with the new values. See ConductorOne's guide to [authenticating API requests](https://www.c1.ai/docs/conductorone-api/authenticate).
  </Accordion>
</AccordionGroup>

***

Need help? Contact **[support@serval.com](mailto:support@serval.com)** for assistance with your ConductorOne integration.