> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-jorge-mcp-resources-documentation.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Zuora connector

> C1 provides identity governance and just-in-time provisioning for Zuora. Integrate your Zuora instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

## Capabilities

| Resource | Sync                                                          | Provision                                                     |
| :------- | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Accounts | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Groups   | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Roles    | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |

**Additional functionality:**
The Zuora connector supports [automatic account provisioning](/product/admin/account-provisioning).

**Notes:**

* The connector syncs users, security groups, and roles through the Zuora OneID SCIM 2.0 API.
* Roles live on each user's `roles` attribute (no standalone `/Roles` endpoint). The connector discovers the open-ended role catalog by paginating users during role sync (one page per List call; sync dedupes) and emits membership grants from each account.
* SCIM models `roles` as a multi-valued attribute. Granting a role appends it to the user's current `roles[]`; revoking removes only that value and leaves any other roles intact. Revoking the last remaining role is rejected.
* Account creation creates SSO (federated) users by default and returns the existing user when the username already exists.

## Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the [Perform connector action](/product/admin/automations-steps-reference#perform-connector-action) automation step.

| Action name      | Additional fields                                                                                                      | Description                                                                                    |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| `enable_user`    | `user_id` (string, required)                                                                                           | Reactivates a Zuora OneID user by setting `active` to `true`                                   |
| `disable_user`   | `user_id` (string, required)                                                                                           | Deactivates a Zuora OneID user by setting `active` to `false`                                  |
| `update_user`    | `user_id` (string, required); `user_profile` (JSON string, required)                                                   | Updates profile attributes from a JSON object (used by C1 push rules / automated profile sync) |
| `update_profile` | `user_id` (resource, required); `displayName`, `givenName`, `familyName`, `externalId`, `custom_attributes` (optional) | Updates a user's name, display name, federated ID, or non-reserved profile attributes          |

## Understanding roles in Zuora

Zuora OneID stores role membership on the SCIM user resource (`roles[]`), not as a separate Roles collection. At sync time the connector:

1. Discovers role resources by paginating users and reading `user.roles[]` during role sync (always seeds `USER` on the first page; docs mention `USER` / `ADMIN`, but any additional values present on users are included — the catalog is open-ended; duplicate role resources across pages are ignored by sync).
2. Emits membership grants from each user (`profile["roles"]`) so there is no role→members scan and no shared user cache between builders.

* Granting a role appends it to the user's existing `roles[]`.
* Revoking a role removes only that value and preserves the user's other roles.
* Revoking the user's last remaining role is rejected because Zuora requires at least one role.

## Gather Zuora credentials

<Warning>
  To configure the Zuora connector, you need administrator access in Zuora OneID to create an OAuth 2.0 client with the **admin** scope.
</Warning>

<Steps>
  <Step>
    Sign in to your Zuora account as an administrator.
  </Step>

  <Step>
    Create an OAuth 2.0 client:

    1. Navigate to **Platform** > **API** > **OAuth Clients**.
    2. Click **Create OAuth Client**.
    3. Select **Client Credentials** as the grant type.
    4. Grant the client the **admin** scope.

    <Warning>
      The **admin** scope is used by C1 when automatically provisioning and deprovisioning access. **If you do not want C1 to perform these tasks, do not grant this scope.**
    </Warning>

    5. Click **Create**.
    6. Copy and save the **Client ID** and **Client Secret** securely. The secret is shown only once.
  </Step>
</Steps>

For more information, see [Zuora authentication](https://developer.zuora.com/rest-api/general-concepts/authentication/) and the [Zuora SCIM API](https://developer.zuora.com/v1-api-reference/api/scim).

## Configure the Zuora connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Zuora** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Zuora connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
        * Add the connector to a managed app (select from the list of existing managed apps)
        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 notifies the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Paste the credentials into the relevant fields:

        * **zuora-domain** (required): Zuora OneID domain (e.g. `https://one.zuora.com`)
        * **zuora-client-id** (required): OAuth 2.0 Client ID for Zuora OneID
        * **zuora-client-secret** (required): OAuth 2.0 Client Secret for Zuora OneID
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Zuora connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to use the [Zuora](https://github.com/conductorone/baton-zuora) connector, hosted and run in your own environment.

    When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

    ### Resources

    * [Official download center](https://dist.conductorone.com/ConductorOne/baton-zuora): For stable binaries (Windows/Linux/macOS) and container images.

    * [GitHub repository](https://github.com/conductorone/baton-zuora): Access the source code, report issues, or contribute to the project.

    ### Step 1: Set up a new Zuora connector

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Zuora connector:

        * Add the connector to a currently unmanaged app
        * Add the connector to a managed app
        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        In the **Settings** area of the page, click **Edit**.
      </Step>

      <Step>
        Click **Rotate** to generate a new Client ID and Secret.

        Carefully copy and save these credentials. We'll use them in Step 2.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your Zuora connector deployment:

    #### Secrets configuration

    ```yaml expandable theme={null}
    # baton-zuora-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-zuora-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>

      # Zuora credentials
      BATON_ZUORA_DOMAIN: <Zuora OneID domain, e.g. https://one.zuora.com>
      BATON_ZUORA_CLIENT_ID: <Zuora OAuth Client ID>
      BATON_ZUORA_CLIENT_SECRET: <Zuora OAuth Client Secret>

      # Optional: include if you want C1 to provision access using this connector
      BATON_PROVISIONING: true
    ```

    See the connector's README or run `--help` to see all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={null}
    # baton-zuora.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-zuora
      labels:
        app: baton-zuora
    spec:
      selector:
        matchLabels:
          app: baton-zuora
      template:
        metadata:
          labels:
            app: baton-zuora
            baton: true
            baton-app: zuora
        spec:
          containers:
          - name: baton-zuora
            image: public.ecr.aws/conductorone/baton-zuora:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-zuora
            envFrom:
            - secretRef:
                name: baton-zuora-secrets
    ```

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
      </Step>

      <Step>
        Check that the connector data uploaded correctly. In C1, click **Applications**. On the **Managed apps** tab, locate and click the name of the application you added the Zuora connector to. Zuora data should be found on the **Entitlements** and **Accounts** tabs.
      </Step>
    </Steps>

    **Done.** Your Zuora connector is now pulling access data into C1.
  </Tab>
</Tabs>