> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ManageEngine Endpoint Central

> Connect ManageEngine Endpoint Central Cloud to Serval so workflows can manage devices, patches, inventory, and security reports on demand.

## About ManageEngine Endpoint Central

ManageEngine Endpoint Central (formerly Desktop Central) is a unified endpoint management (UEM) platform for managing computers, mobile devices, patching, and inventory. Serval connects to Endpoint Central Cloud, the Zoho-hosted edition, using a Serval-managed Zoho OAuth application - there is nothing to register or configure on the ManageEngine or Zoho side. The integration is fully region-aware: your Zoho data center (US, EU, IN, AU, JP, CN, or SA) is detected automatically when you connect.

**Authentication:** Zoho OAuth 2.0 with a Serval-managed application. A click-through authorization flow - no API keys or credentials to paste.

**Data sync:** On demand only. There is no background sync or scheduled ingestion; workflows call Endpoint Central at run time through a single API request action.

## What the ManageEngine Endpoint Central integration enables

| Capability                      | Description                                                                                                                                                                                        |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| API request action              | A single typed action, "ManageEngine Endpoint Central API request", covering 112 documented API operations, with automatic authentication and token refresh.                                       |
| Scope of Management             | List managed computers and remote offices, view the SOM summary, install, uninstall, or remove agents, and list custom groups.                                                                     |
| Patch management                | View patch summaries and reports, scan computers, approve, decline, or unapprove patches, install or uninstall patches, and manage automated patch deployment (APD) tasks and deployment policies. |
| Inventory                       | Hardware and software inventory, installed software per computer, license and software metering data, prohibited software, and on-demand inventory scans.                                          |
| Vulnerability and threat data   | Read vulnerabilities, threat patches, server and system misconfigurations, and per-system threat reports (read-only).                                                                              |
| Mobile Device Management        | Module access granted by the **Mobile Device Management** permission preset: workflows can view and manage mobile device policies and enrollments through the Endpoint Central MDM module.         |
| Remote tools and configurations | Module access granted by the **Remote Tools** and **Configurations** permission presets: workflows can view and manage remote control sessions and tools, plus system configurations and policies. |
| Security and compliance reports | BitLocker reports including recovery key details and TPM status, device control audit reports, and DLP reports.                                                                                    |
| Custom fields and reporting     | Custom columns and custom field values for computers, custom reports and query reports with data export, and endpoint analytics scores.                                                            |

Anything defined in the [ManageEngine Endpoint Central API](https://www.manageengine.com/products/desktop-central/api/cloud_index.html) can be accessed through Serval.

## Get your credentials

There is nothing to create in any provider console. Serval uses its own managed Zoho OAuth application, so you never register an app, generate a client ID, or copy a secret. You only need two things in place before connecting:

<Steps>
  <Step title="Confirm you have Endpoint Central Cloud">
    The integration works with the cloud product only. If your team runs a self-hosted (on-premises) Endpoint Central server, it cannot be connected. See the [Endpoint Central Cloud API documentation](https://www.manageengine.com/products/desktop-central/api/cloud_index.html) for an overview of what the cloud edition exposes.
  </Step>

  <Step title="Identify the linked Zoho account">
    Know which Zoho account is linked to your Endpoint Central instance, and make sure it has admin privileges for the modules you plan to use (patching, inventory, MDM, and so on). This is the account you will sign in with on the Zoho consent screen.
  </Step>
</Steps>

<Note>
  Cloud only: on-premises Endpoint Central servers are not supported by this integration.
</Note>

<Tip>
  Your regional Zoho data center (US, EU, IN, AU, JP, CN, or SA) is detected automatically during connection - there is no region picker and nothing to look up in advance.
</Tip>

## Connect in Serval

<Steps>
  <Step title="Open the connect modal">
    In Serval, go to **Apps > Available > ManageEngine Endpoint Central**. A permissions modal opens with the message: "Common read and update permissions are always included. Select any additional module permissions your workflows need. You can always reconnect later to change permissions."
  </Step>

  <Step title="Select permission presets (all optional)">
    Under **Permission Presets** ("Select the permissions you need for your workflows"), check any of the seven optional presets. There are no text inputs - these checkboxes are the only choices, and base read and update permissions are always included automatically.

    | Preset                   | What it grants                                                                                                                                |
    | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
    | Scope of Management      | "View and manage computer groups and managed devices" - `DesktopCentralCloud.SOM.READ`, `DesktopCentralCloud.SOM.UPDATE`                      |
    | Patch Management         | "View and manage patches, updates, and vulnerability scans" - `DesktopCentralCloud.PatchMgmt.READ`, `DesktopCentralCloud.PatchMgmt.UPDATE`    |
    | Inventory                | "View and manage hardware and software inventory" - `DesktopCentralCloud.Inventory.READ`, `DesktopCentralCloud.Inventory.UPDATE`              |
    | Vulnerability Management | "View vulnerability assessment and management data" - `DesktopCentralCloud.VulnerabilityMgmt.READ` (read-only)                                |
    | Mobile Device Management | "View and manage mobile device policies and enrollments" - `MDMOnDemand.MDMDeviceMgmt.READ`, `MDMOnDemand.MDMDeviceMgmt.UPDATE`               |
    | Remote Tools             | "View and manage remote control sessions and tools" - `DesktopCentralCloud.Tools.READ`, `DesktopCentralCloud.Tools.UPDATE`                    |
    | Configurations           | "View and manage system configurations and policies" - `DesktopCentralCloud.Configurations.READ`, `DesktopCentralCloud.Configurations.UPDATE` |

    Expand any preset row to see the exact permission strings it grants, each with a short description. A live counter shows "\[number] additional permissions selected" as you check boxes - it counts individual permissions, not presets (most presets add two).
  </Step>

  <Step title="Click Connect to Endpoint Central">
    Click **Connect to Endpoint Central** (the button reads "Connecting..." while the authorization starts). Authorization opens in a popup window or a full-page redirect. If Serval cannot start the authorization, you will see "Failed to initiate OAuth: \[status text]" or "OAuth initiation failed" - retry, and contact support if it persists.
  </Step>

  <Step title="Approve on the Zoho consent screen">
    Sign in with the Zoho account linked to your Endpoint Central instance and approve the requested permissions. The consent screen appears on every connect and reconnect - this is expected.
  </Step>

  <Step title="Region detected automatically">
    Serval detects your Zoho data center from the authorization response and stores it with the connection. All API calls and token refreshes use your regional servers from then on.
  </Step>
</Steps>

<Note>
  Base read and update permissions (`DesktopCentralCloud.Common.READ` and `DesktopCentralCloud.Common.UPDATE`) are always requested, even if you select no presets. Selecting no presets still produces a working connection for basic operations.
</Note>

<Tip>
  Permissions are fixed at connect time. If your workflows later need a module you did not select, reconnect the integration and check the additional presets.
</Tip>

## Verifying the connection

After connecting, Serval runs two health checks:

**Test ManageEngine Endpoint Central Connection** verifies that Serval can authenticate against your regional Endpoint Central Cloud instance using the always-included base permissions.

* Success: "Successfully authenticated with ManageEngine Endpoint Central"
* Failure (invalid or expired token): "Unable to authenticate with ManageEngine Endpoint Central. The OAuth token is invalid or expired - please reconnect the integration."
* Failure (other): "Unable to reach ManageEngine Endpoint Central. Please verify the integration's regional data center and OAuth credentials are valid."

**List ManageEngine Managed Computers** verifies that Serval can list managed computers through the Scope of Management module, fetching a sample of at most one computer.

* Success: "Successfully listed managed computers from ManageEngine Endpoint Central (sample size: \[number])" - the number is 0 or 1 depending on how many computers your instance returned
* Failure: "Unable to list managed computers from ManageEngine Endpoint Central. Please verify the integration has the necessary permissions."

<Tip>
  If **Test ManageEngine Endpoint Central Connection** passes but **List ManageEngine Managed Computers** fails, the most likely cause is a missing permission: reconnect and select the **Scope of Management** preset.
</Tip>

## Gotchas and troubleshooting

<AccordionGroup>
  <Accordion title="Workflows fail with permission or insufficient-scope errors">
    Permissions are baked into the OAuth grant when you connect - they cannot be edited in place. If a workflow hits a 403 or insufficient-scope error, reconnect the integration and select the additional presets the workflow needs. The connect modal reminds you: "You can always reconnect later to change permissions."
  </Accordion>

  <Accordion title="Authentication failed or token refresh stopped working">
    If health checks report an invalid or expired token, reconnect the integration. Make sure you sign in with the Zoho account that is actually linked to your Endpoint Central instance and that it still has admin privileges for the modules you authorized. Token refresh is automatic; a persistent failure usually means the grant was revoked on the Zoho side and a fresh connect is required.
  </Accordion>

  <Accordion title="Cloud only - on-premises Endpoint Central is not supported">
    The integration only reaches Endpoint Central Cloud regional domains (endpointcentral.manageengine.com and its eu, in, com.au, jp, com.cn, and sa counterparts). Self-hosted Endpoint Central servers cannot be connected.
  </Accordion>

  <Accordion title="Wrong region or unreachable instance on an older connection">
    Your regional data center is detected and stored when you connect. Connections created before regional support default to the US region; if your organization is hosted in the EU, IN, AU, JP, CN, or SA data center and you see "Unable to reach ManageEngine Endpoint Central" failures on an older connection, reconnect so the correct region is captured.
  </Accordion>

  <Accordion title="The Zoho consent screen appears every time you connect">
    This is by design. Serval always requests the full consent flow because Zoho only reliably issues refresh tokens that way. Seeing the complete consent screen on every reconnect is normal, not a sign of a broken session.
  </Accordion>

  <Accordion title="Vulnerability Management is read-only">
    The Vulnerability Management preset grants read access only. Workflows can read vulnerability, threat, and misconfiguration data but cannot make changes through this preset.
  </Accordion>

  <Accordion title="Authorization header differs from ManageEngine's curl examples">
    Endpoint Central expects a Zoho-specific authorization scheme rather than the standard Bearer scheme. Serval injects the correct header automatically on every request, so no action is needed - this only matters if you are comparing behavior against raw examples from the ManageEngine API documentation.
  </Accordion>
</AccordionGroup>

For more detail, see the [Endpoint Central Cloud API documentation](https://www.manageengine.com/products/desktop-central/api/cloud_index.html), the [Endpoint Central API documentation index](https://www.manageengine.com/products/desktop-central/api/), the [Zoho OAuth 2.0 overview](https://www.zoho.com/accounts/protocol/oauth.html), and [Zoho multi-data-center OAuth](https://www.zoho.com/accounts/protocol/oauth/multi-dc.html).

***

Need help? Contact **[support@serval.com](mailto:support@serval.com)** for assistance with your ManageEngine Endpoint Central integration.