From c0424852e515c3f16541bdbce298f771f81a4233 Mon Sep 17 00:00:00 2001 From: Carolina Roncaglia Date: Sat, 22 Aug 2026 12:42:32 -0300 Subject: [PATCH 1/2] docs: correct README install and action examples, and connector.mdx scopes The README's `go install` line pointed at the retired standalone CLI module, whose build does not serialise resource-level profile or status fields. The docker example passed config flags the connector does not define. Both action arguments were documented without their value format, and the examples used a placeholder the integer check rejects. In connector.mdx, the OAuth read/write list asked for two write scopes the connector never requests, and the page was missing the account-group opt-in note and the conditional accounting scope that the published page already carries. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 25 ++++++++++++++++++------- docs/connector.mdx | 18 +++++++++++------- 2 files changed, 29 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 582c0a12..7e79de57 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ # `baton-coupa` [![Go Reference](https://pkg.go.dev/badge/github.com/conductorone/baton-coupa.svg)](https://pkg.go.dev/github.com/conductorone/baton-coupa) ![ci](https://github.com/conductorone/baton-coupa/actions/workflows/ci.yaml/badge.svg) ![verify](https://github.com/conductorone/baton-coupa/actions/workflows/verify.yaml/badge.svg) -`baton-coupa` is a connector for built using the [Baton SDK](https://github.com/conductorone/baton-sdk). +`baton-coupa` is a connector for Coupa built using the [Baton SDK](https://github.com/conductorone/baton-sdk). It communicates with the Coupa API to sync data about users, user groups, roles, per-module licenses, account groups and content groups, and supports provisioning of group, role, license, account-group and content-group membership as well as Coupa user accounts. Check out [Baton](https://github.com/conductorone/baton) to learn more the project in general. @@ -23,14 +23,20 @@ baton resources ## docker ``` -docker run --rm -v $(pwd):/out -e BATON_DOMAIN_URL=domain_url -e BATON_API_KEY=apiKey -e BATON_USERNAME=username ghcr.io/conductorone/baton-coupa:latest -f "/out/sync.c1z" +docker run --rm -v $(pwd):/out -e BATON_COUPA_DOMAIN=acme.coupacloud.com -e BATON_COUPA_CLIENT_ID=clientId -e BATON_COUPA_CLIENT_SECRET=clientSecret ghcr.io/conductorone/baton-coupa:latest -f "/out/sync.c1z" docker run --rm -v $(pwd):/out ghcr.io/conductorone/baton:latest -f "/out/sync.c1z" resources ``` ## source +The `baton` CLI cannot be installed with `go install` — its module carries `replace` +directives, which `go install` rejects. Build it from a checkout, or take a prebuilt binary +from the [baton-sdk releases](https://github.com/ConductorOne/baton-sdk/releases). + ``` -go install github.com/conductorone/baton/cmd/baton@main +git clone --depth 1 https://github.com/ConductorOne/baton-sdk.git +cd baton-sdk && go build -o "$(go env GOPATH)/bin/baton" ./cmd/baton && cd - + go install github.com/conductorone/baton-coupa/cmd/baton-coupa@main baton-coupa @@ -49,6 +55,11 @@ baton resources - Account Groups - Content Groups +Account Groups sync is opt-in: enable the resource type when configuring the connector in C1, +and add the `core.accounting.read` scope to your Coupa OAuth client. + +Grant, revoke and account creation require the `--provisioning` flag (`BATON_PROVISIONING`). + # Actions `baton-coupa` supports the following actions on user accounts: @@ -59,14 +70,14 @@ Enables a disabled user account in Coupa. **Action Name:** `enable_user` **Arguments:** -- `user_id` (required, string): The ID of the user to enable +- `user_id` (required, string): The Coupa user's numeric ID — the `id` field on `/api/users`, passed as a string (for example `"42"`). A login or an email address is rejected. **Returns:** - `success` (boolean): `true` if the user was successfully enabled **Example:** ```bash -baton-coupa --invoke-action enable_user --invoke-action-args='{"user_id":"USER_ID"}' +baton-coupa --invoke-action enable_user --invoke-action-args='{"user_id":"42"}' ``` ## Disable User @@ -75,14 +86,14 @@ Disables an active user account in Coupa. **Action Name:** `disable_user` **Arguments:** -- `user_id` (required, string): The ID of the user to disable +- `user_id` (required, string): The Coupa user's numeric ID — the `id` field on `/api/users`, passed as a string (for example `"42"`). A login or an email address is rejected. **Returns:** - `success` (boolean): `true` if the user was successfully disabled **Example:** ```bash -baton-coupa --invoke-action disable_user --invoke-action-args='{"user_id":"USER_ID"}' +baton-coupa --invoke-action disable_user --invoke-action-args='{"user_id":"42"}' ``` # Contributing, Support and Issues diff --git a/docs/connector.mdx b/docs/connector.mdx index 726e4835..64cf7e74 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -15,12 +15,14 @@ sidebarTitle: "Coupa" | Resource | Sync | Provision | | :--- | :--- | :--- | | Accounts | | | -| Account Groups | | | +| Account Groups 1 | | | | Content Groups | | | | Groups | | | | Roles | | | | Licenses | | | +1 Account Groups sync is opt-in. To enable it, select **Account Groups** in the resource types to sync when configuring the connector in C1, and ensure the `core.accounting.read` OAuth scope is added to your Coupa OAuth client. + The **Licenses** resource surfaces each user's Coupa license assignments — such as Analytics, Purchasing, Sourcing, CLM Advanced, Navi AI Agent, and Intake — as license profiles, so they can be reviewed and provisioned through C1 License Management. ### Connector actions @@ -29,8 +31,8 @@ Connector actions are custom capabilities that extend C1 automations with app-sp | Action name | Additional fields | Description | |-------------|-------------------|-------------| -| enable_user | `user_id` (string, required) | Enables a disabled user account in Coupa, allowing them to access the system | -| disable_user | `user_id` (string, required) | Disables an active user account in Coupa, preventing them from accessing the system | +| enable_user | `user_id` (string, required) — the Coupa user's numeric ID, the `id` field on `/api/users` | Enables a disabled user account in Coupa, allowing them to access the system | +| disable_user | `user_id` (string, required) — the Coupa user's numeric ID, the `id` field on `/api/users` | Disables an active user account in Coupa, preventing them from accessing the system | ## Gather Coupa credentials @@ -69,7 +71,6 @@ A user with **Admin** access in Coupa must perform this task. - Select scopes: **You'll need these scopes to give C1 READ access (syncing access data):** - - core.accounting.read - core.business_entity.read - core.common.read - core.user_group.read @@ -79,12 +80,12 @@ A user with **Admin** access in Coupa must perform this task. - openid - profile - **You'll need these scopes to give C1 READ/WRITE access (syncing access data and provisioning access):** + **If you also want to sync Account Groups, add:** - core.accounting.read + + **You'll need these scopes to give C1 READ/WRITE access (syncing access data and provisioning access):** - core.business_entity.read - - core.business_entity.write - core.common.read - - core.common.write - core.user_group.read - core.user_group.write - core.user.read @@ -93,6 +94,9 @@ A user with **Admin** access in Coupa must perform this task. - login - openid - profile + + **If you also want to sync and provision Account Groups, add:** + - core.accounting.read At the bottom of the page click **Save**. From 732b7e9df11efbdb1566a26a8bbbc28e3c268138 Mon Sep 17 00:00:00 2001 From: Carolina Roncaglia Date: Sat, 22 Aug 2026 12:45:40 -0300 Subject: [PATCH 2/2] docs: use a superscript character for the footnote marker The MDX renderer for connector pages allows a fixed set of components and `sup` is not among them, so the footnote marker has to be a literal character. This also matches how the published page renders it. Co-Authored-By: Claude Opus 5 (1M context) --- docs/connector.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/connector.mdx b/docs/connector.mdx index 64cf7e74..7d3e6d89 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -15,13 +15,13 @@ sidebarTitle: "Coupa" | Resource | Sync | Provision | | :--- | :--- | :--- | | Accounts | | | -| Account Groups 1 | | | +| Account Groups ¹ | | | | Content Groups | | | | Groups | | | | Roles | | | | Licenses | | | -1 Account Groups sync is opt-in. To enable it, select **Account Groups** in the resource types to sync when configuring the connector in C1, and ensure the `core.accounting.read` OAuth scope is added to your Coupa OAuth client. +¹ Account Groups sync is opt-in. To enable it, select **Account Groups** in the resource types to sync when configuring the connector in C1, and ensure the `core.accounting.read` OAuth scope is added to your Coupa OAuth client. The **Licenses** resource surfaces each user's Coupa license assignments — such as Analytics, Purchasing, Sourcing, CLM Advanced, Navi AI Agent, and Intake — as license profiles, so they can be reviewed and provisioned through C1 License Management.