Set up a Kyriba connector

Capabilities

The Kyriba connector syncs the following resources:

Resource	Sync	Provision
Users
Access Profiles
Data Permission Profiles
User Groups

Gather Kyriba credentials

To configure the Kyriba connector, you need administrator access to the Kyriba Developer Portal to create API credentials.

The connector authenticates using OAuth2 client credentials. You will need:

Kyriba URL — the base URL of your Kyriba instance, including the API gateway path (the host and path are tenant-specific — for example, https://<your-tenant-host>/api or https://<your-tenant-host>/gateway/api). Confirm the exact value with your Kyriba administrator.
Token URL — the OAuth2 token endpoint (for example, https://<your-tenant-host>/gateway/oauth/token; the host may differ from the API host, such as an auth. subdomain)
Client ID — your OAuth2 client identifier
Client Secret — your OAuth2 client secret

Create a new OAuth2 application or API credential set named ConductorOne.

Grant the following OAuth scopes to enable full sync and provisioning:

Scope	Used for
`user-scope`	Sync users and access profiles; create and delete users; assign data permission profiles
`user-group-scope`	Sync user groups; add and remove members
`data-permission-profile-scope`	Sync data permission profiles

For sync-only (read) access, all three scopes are still required. Provisioning requires write permissions on the relevant scopes: user-scope for account creation/deletion and data permission profile assignment; user-group-scope for group membership changes. Note that user update and deletion — used for data-permission-profile assignment (PUT /v1/users/{ref}) and account deprovisioning (DELETE /v1/users/{ref}) — require broader user-management permission than user creation. A credential granted only create + read access may sync and create users successfully but return 403 Forbidden on updates and deletes; grant full user-management permission if you need deprovisioning or data-permission-profile assignment.

Copy the Client ID, Client Secret, and Token URL. Save these securely — the secret cannot be retrieved again after creation.

Configure the Kyriba connector

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Integrations > Connectors and click Add connector.

Search for Kyriba and click Add.

Choose how to set up the new Kyriba connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector.

Click Next.

Find the Settings area of the page and click Edit.

Enter the required configuration:

Kyriba URL: The base URL of your Kyriba instance (for example, https://api.kyriba.com)
Token URL: The OAuth2 token endpoint URL (for example, https://api.kyriba.com/gateway/oauth/token)
Kyriba Client ID: Your OAuth2 client ID from the Kyriba Developer Portal
Kyriba Client Secret: Your OAuth2 client secret from the Kyriba Developer Portal

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Kyriba connector is now pulling access data into C1.

Follow these instructions to use the Kyriba connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals.

Resources

Official download center: For stable binaries (Windows/Linux/macOS) and container images.
GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Kyriba connector

In C1, navigate to Integrations > Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new Kyriba connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector.

Click Next.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Kyriba connector deployment:

Secrets configuration

# baton-kyriba-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-kyriba-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Kyriba credentials
  BATON_KYRIBA_URL: https://<your-tenant-host>/api
  BATON_TOKEN_URL: https://<your-tenant-host>/gateway/oauth/token
  BATON_KYRIBA_CLIENT_ID: <Kyriba OAuth2 client ID>
  BATON_KYRIBA_CLIENT_SECRET: <Kyriba OAuth2 client secret>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-kyriba.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-kyriba
  labels:
    app: baton-kyriba
spec:
  selector:
    matchLabels:
      app: baton-kyriba
  template:
    metadata:
      labels:
        app: baton-kyriba
        baton: "true"
        baton-app: kyriba
    spec:
      containers:
      - name: baton-kyriba
        image: public.ecr.aws/conductorone/baton-kyriba:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-kyriba
        envFrom:
        - secretRef:
            name: baton-kyriba-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Applications. On the Managed apps tab, locate and click the name of the application you added the Kyriba connector to. Kyriba data should be found on the Entitlements and Accounts tabs.

Done. Your Kyriba connector is now pulling access data into C1.

Troubleshooting

Sync or provisioning fails with a non-JSON response — If you see an error mentioning a non-JSON response and to “check that kyriba-url is configured correctly” (or, on connector versions before v0.0.3, invalid character '<'), the Kyriba URL is almost certainly missing the API gateway path. Kyriba serves the REST API under a tenant-specific path (for example /api or /gateway/api); a base URL pointing at the bare host returns an HTML page instead of JSON. Set Kyriba URL to https://<your-tenant-host>/<gateway-path> and re-run.

Known Limitations

Access profiles with no assigned users — The Kyriba API does not expose a standalone list endpoint for access profiles. ConductorOne derives access profile resources from user-assignment data. Any access profile that exists in Kyriba but has no users currently assigned to it will not appear in the ConductorOne catalog until at least one user is assigned to it and a sync completes.

All versions of this connector are available at dist.conductorone.com.

Set up a Kubernetes connector

Set up a Kustomer connector

⌘I

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Kyriba connector

Capabilities

Gather Kyriba credentials

Configure the Kyriba connector

Resources

Step 1: Set up a new Kyriba connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Troubleshooting

Known Limitations

​Capabilities

​Gather Kyriba credentials

​Configure the Kyriba connector

​Resources

​Step 1: Set up a new Kyriba connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

​Troubleshooting

​Known Limitations

Capabilities

Gather Kyriba credentials

Configure the Kyriba connector

Resources

Step 1: Set up a new Kyriba connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Troubleshooting

Known Limitations