Set up an Outreach connector

C1 provides identity governance and just-in-time provisioning for Outreach. Integrate your Outreach instance with C1 to run user access reviews (UARs) and enable just-in-time access requests.

Capabilities

Resource	Sync	Provision
Accounts
Profiles
Teams

The Outreach connector supports automatic account provisioning and deprovisioning.

Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the Perform connector action automation step.

Action name	Additional fields	Description
enable_user	user_id (string, required)	Enables a disabled Outreach user account
disable_user	user_id (string, required)	Disables an active Outreach user account

Gather Outreach credentials

Configuring the connector requires you to pass in credentials generated in Outreach. Gather these credentials before you move on.

A user who is an admin in Outreach must perform this task.

Create an OAuth application

1. In Outreach, navigate to Admin Home > Installed apps.

2. Click Create new app.

3. Click Create app.

4. Give the new app a name, such as “C1”, then click Create.

5. The new app’s details view opens. Click Feature selection.

6. Select Outreach API (OAuth) and click Add feature.

7. Carefully copy and save the OAuth Application ID and Application Secret.

8. Enter a callback URL for your app.

9. Select the relevant scopes for the app:

   To sync access data (READ):

   • User: Read
   • Teams: Read
   • Profiles: Read

   To sync access data and provision accounts and entitlements (READ/WRITE):

   • User: All
   • Teams: All
   • Profiles: All

   Reauthorize the connector if you change which permissions are granted to the OAuth app.

   If, for example, you previously set up the Outreach connector with READ permissions, then updated the Outreach OAuth app to grant READ/WRITE permissions, you must re-authorize the OAuth app for the changes to take effect.

10. Save the app. If desired, create a release.

Done. Next, move on to the connector configuration instructions.

Configure the Outreach connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in C1
• Access to the set of Outreach credentials generated by following the instructions above

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Apps > Connectors and click Add connector.

2. Search for Outreach and click Add.

3. Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).

   If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

4. Set the connector’s Name and, optionally, a Description.

5. Click the pencil icon next to Owners to choose who can configure and manage this connector.

6. Click Add. The connector is created and its configuration page opens.

7. Find the Settings area of the page and click Edit.

8. Paste the the OAuth application ID and application secret into the Client ID and Client secret fields.

9. Click Login with OAuth.

10. Log into Outreach and authorize C1.

    After authorizing, you’ll be redirected back to the C1 integrations page, where an “Authorized as” message is now printed.

    Remember: Reauthorize the connector if you change the permissions that are granted to the Outreach OAuth app.

11. Click Save.

12. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Outreach connector is now pulling access data into C1.

Self-hosted

Follow these instructions to use the Outreach connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

• Official download center: For stable binaries (Windows/Linux/macOS) and container images.

• GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Outreach connector

1. In C1, navigate to Apps > Connectors and click Add connector.

2. Search for Baton and click Add.

3. Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).

   If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

4. Set the connector’s Name and, optionally, a Description.

5. Click the pencil icon next to Owners to choose who can configure and manage this connector.

6. Click Add. The connector is created and its configuration page opens.

7. In the Settings area of the page, click Edit.

8. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Outreach connector deployment:

Secrets configuration

# baton-outreach-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-outreach-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>
  
  # Outreach credentials
  BATON_OUTREACH_CLIENT_ID: <Outreach app ID>
  BATON_OUTREACH_CLIENT_ID: <Outreach app secret>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-outreach.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-outreach
  labels:
    app: baton-outreach
spec:
  selector:
    matchLabels:
      app: baton-outreach
  template:
    metadata:
      labels:
        app: baton-outreach
        baton: true
        baton-app: outreach
    spec:
      containers:
      - name: baton-outreach
        image: public.ecr.aws/conductorone/baton-outreach:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-outreach
        envFrom:
        - secretRef:
            name: baton-outreach-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Outreach connector to. Outreach data should be found on the Entitlements and Accounts tabs.

Done. Your Outreach connector is now pulling access data into C1.