Set up a Coupa connector

C1 provides identity governance for Coupa. Integrate your Coupa instance with C1 to run user access reviews (UARs) and enable just-in-time access requests.

This is an updated and improved version of the Coupa connector! If you’re setting up Coupa with C1 for the first time, you’re in the right place.

Capabilities

Resource	Sync	Provision
Accounts
Account Groups ¹
Content Groups
Groups
Roles
Licenses

¹ Account Groups sync is opt-in. To enable it, select Account Groups in the resource types to sync when configuring the connector in C1, and ensure the core.accounting.read OAuth scope is added to your Coupa OAuth client.

The Licenses resource surfaces each user’s Coupa license assignments — such as Analytics, Purchasing, Sourcing, CLM Advanced, Navi AI Agent, and Intake — as license profiles, so they can be reviewed and provisioned through C1 License Management.

Account provisioning

C1 can create Coupa user accounts. When you configure account provisioning for the app, map these profile fields:

Field	Description
First name	First name of the person who will own the Coupa user.
Last name	Last name of the person who will own the Coupa user.
Email	Email address of the Coupa user. Defaults to the C1 user’s primary email.
Login	Login for the Coupa user. Defaults to the C1 user’s username.
SSO identifier	Single sign-on identifier for the Coupa user.
Employee number	Employee number for the Coupa user.
Manager login	Login of the user’s manager in Coupa.
Purchasing user	Assign a Purchasing license when the account is created.
Invoicing user	Assign an Invoicing license when the account is created.
Sourcing user	Assign a Sourcing license when the account is created.
Account security type	Numeric Coupa account security type.
Authentication method	coupa_credentials, ldap, or saml; values are case-sensitive. Only the methods enabled on your Coupa instance are accepted.
Default locale	Default locale, such as en or en-GB.
Default account type	Name of the user’s default Coupa account type.
Default currency	ISO currency code, such as USD.
Custom fields	Map of your Coupa instance’s custom user field names to values, for example {"cost-center": "CC-100"}.

Every field is optional to C1. Map First name and Last name regardless — Coupa has no other source for a new user’s name.

Accounts are created active. The connector does not set a password.

Custom fields are sent in Coupa’s custom-fields namespace. License assignments can also be managed after account creation through C1 License Management.

The connector trims surrounding whitespace from Email, Login, SSO identifier, Employee number, Manager login, Authentication method, Default locale, Default account type, and Default currency. A value that is only whitespace counts as unmapped. First name and Last name are sent as-is.

Purchasing user, Invoicing user, and Sourcing user must be mapped to boolean values, and Account security type to a number. A value of any other type, such as the text "false", is ignored and not sent to Coupa. Custom field values are sent with the type they are mapped with.

The extended attributes are set only when the account is created. The connector does not update SSO identifier, employee number, manager, security and authentication settings, locale, default account type, default currency, or custom fields on existing Coupa users. It also does not sync these attributes back into C1: synced Coupa accounts carry only login, email, name, and status.

Mapping examples

Mappings in C1 are expressions. Wrap text constants in quotes; booleans and numbers take no quotes. The C1 user has no separate first and last name, so derive them from the display name.

Field	Example mapping
First name	subject.display_name.split(" ")[0]
Last name	subject.display_name.substring(subject.display_name.indexOf(" ") + 1)
Email	subject.email
Login	subject.username
Employee number	A value unique per user, such as subject.id. Coupa requires employee numbers to be unique, so a constant fails from the second account on.
Manager login	"jane.manager"
Purchasing user	true
Default currency	"USD"
Custom fields	{"cost-center": "CC-100", "remote": true, "desk-number": 42}

How Coupa applies some values

• License flags. If an account would be created with no license at all — for example, with Purchasing user, Invoicing user, and Sourcing user all mapped to false — Coupa assigns the Purchasing license anyway. To create a user without Purchasing, map at least one other license flag to true.
• Custom field names. Coupa accepts either the hyphenated or the underscore form of a custom field name (for example cost-center or cost_center) and reports it in the hyphenated form. A name that doesn’t match an existing custom user field is ignored without an error, so check the spelling against an existing user’s custom-fields in the Coupa Users API.
• Integer custom fields are returned by Coupa as decimal strings, for example "42.0".
• Rejected values. If Coupa rejects a value — an authentication method your instance doesn’t enable, or an account type, currency, or manager that doesn’t exist — the account isn’t created and the connector returns Coupa’s error message, for example Authentication Method must be one of Coupa Credentials.

Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the Perform connector action automation step.

Action name	Additional fields	Description
enable_user	user_id (string, required) — the Coupa user’s numeric ID, the id field on /api/users	Enables a disabled user account in Coupa, allowing them to access the system
disable_user	user_id (string, required) — the Coupa user’s numeric ID, the id field on /api/users	Disables an active user account in Coupa, preventing them from accessing the system

Gather Coupa credentials

Configuring the connector requires you to pass in credentials generated in Coupa. Gather these credentials before you move on.

A user with Admin access in Coupa must perform this task.

Look up your Coupa domain

1. Log into your Coupa control panel and copy the URL from your browser.

Create an OAuth app

1. In the Coupa control panel, click Setup.

2. Search for “OAuth” and click OAuth2/OpenID Connect Clients.

3. Click Create to create a new OAuth app.

4. Fill out the OAuth app creation form as follows:

   • Select Grant type Client credentials.
   • Give your app a name, such as C1.
   • Leave JWKS URI field blank.
   • Enter the appropriate login and contact information for your organization.
   • Select scopes:

   You’ll need these scopes to give C1 READ access (syncing access data):

   • core.business_entity.read
   • core.common.read
   • core.user_group.read
   • core.user.read
   • login
   • openid
   • profile

   If you also want to sync Account Groups, add:

   • core.accounting.read

   You’ll need these scopes to give C1 READ/WRITE access (syncing access data and provisioning access):

   • core.business_entity.read
   • core.common.read
   • core.user_group.read
   • core.user_group.write
   • core.user.read
   • core.user.write
   • login
   • openid
   • profile

   If you also want to sync and provision Account Groups, add:

   • core.accounting.read
5. At the bottom of the page click Save.

Look up your new OAuth app’s credentials

1. Open the OAuth2 app you just created.

2. Copy and save the Identifier string. This is your client ID.

3. Click Show/Hide to view your client secret. Copy and save the client secret.

Done. Next, move on to the connector configuration instructions.

Configure the Coupa connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in C1
• Access to the set of Coupa credentials generated by following the instructions above

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Apps > Connectors and click Add connector.

2. Search for Coupa v2 and click Add.

3. Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).

   If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

4. Set the connector’s Name and, optionally, a Description.

5. Click the pencil icon next to Owners to choose who can configure and manage this connector.

6. Click Add. The connector is created and its configuration page opens.

7. Find the Settings area of the page and click Edit.

8. Enter your Coupa domain in the Domain field.

9. Paste the client ID into the Client ID field.

10. Paste the client secret into the Client secret field.

11. Click Save.

12. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Coupa connector is now pulling access data into C1.

Self-hosted

Follow these instructions to use the Coupa connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

• Official download center: For stable binaries (Windows/Linux/macOS) and container images.

• GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Coupa connector

1. In C1, navigate to Apps > Connectors and click Add connector.

2. Search for Baton and click Add.

3. Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).

   If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

4. Set the connector’s Name and, optionally, a Description.

5. Click the pencil icon next to Owners to choose who can configure and manage this connector.

6. Click Add. The connector is created and its configuration page opens.

7. In the Settings area of the page, click Edit.

8. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Coupa connector deployment:

Secrets configuration

# baton-coupa-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-coupa-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>
  
  # Coupa-specific credentials
  BATON_COUPA_CLIENT_ID: <Coupa client ID>
  BATON_COUPA_CLIENT_SECRET: <Coupa client secret>
  BATON_COUPA_DOMAIN: <Coupa domain>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-coupa.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-coupa
  labels:
    app: baton-coupa
spec:
  selector:
    matchLabels:
      app: baton-coupa
  template:
    metadata:
      labels:
        app: baton-coupa
        baton: true
        baton-app: coupa
    spec:
      containers:
      - name: baton-coupa
        image: public.ecr.aws/conductorone/baton-coupa:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-coupa
        envFrom:
        - secretRef:
            name: baton-coupa-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Coupa connector to. Coupa data should be found on the Entitlements and Accounts tabs.

Done. Your Coupa connector is now pulling access data into C1.