ConductorOne

ConductorOne is an identity governance and access management platform. The ConductorOne integration polls the System Log API to collect audit and activity events, providing visibility into access requests, approvals, provisioning activities, and administrative actions across your organization.

RunReveal polls the ConductorOne API every 60 seconds to collect new events.

Setup

To connect ConductorOne to RunReveal, you need a Client ID and Client Secret from your ConductorOne account.

Creating API Credentials

1. Sign in to your ConductorOne account.
2. Open the User menu (top-right corner) and select AI & API.
3. Click Create credential to generate a new API key pair.
4. Copy the Client ID and Client Secret values — the secret is only shown once.

The Client ID has the format <random-id>@<hostname>/<use-case>, for example [email protected]/runreveal. RunReveal uses this format to automatically detect your ConductorOne hostname.

Configuring the Source in RunReveal

1. In RunReveal, create a new ConductorOne source and give it a descriptive name.
2. Paste your Client ID into the Client ID field. RunReveal will automatically populate the Hostname field from the Client ID.
3. Paste your Client Secret into the Client Secret field.
4. Save the source. RunReveal will begin polling for events immediately.

Helpful Links

• ConductorOne API Documentation - Full reference for the ConductorOne System Log API and credential management

Verify It’s Working

Once added, logs should begin flowing within a minute. You can validate that RunReveal is receiving your logs by running the following SQL query:

SELECT * FROM runreveal.logs WHERE sourceType = 'conductor-one' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.