Docs update for EU instance

.claude/skills/docs-writing.md

@@ -217,6 +217,35 @@ When documenting features that are in early access, add a standardized warning c
 - Include the explanation of what early access means
 - Use "share feedback" (not "have any feedback")
 
+## Hosting region references (default instance vs. EU data residency)
+
+C1 runs two hosting options — a **default instance** (`conductor.one`) and an **EU data residency instance** (`c1eu.ai`). A tenant is provisioned in one region, and every tenant-specific URL, hostname, or IP address reflects it. See the "Hosting regions" table in [Create a C1 tenant](/product/how-to/qs-set-up-c1) for the canonical explainer — link there rather than re-explaining the concept on other pages.
+
+Anywhere a region-specific value appears, use one of the two treatments below based on how the value is used — not on which section of the docs it's in.
+
+**Single fixed values the reader pastes somewhere** (an OAuth redirect URI, an MCP callback URL, a firewall allowlist entry) — show both values explicitly, labeled by instance, instead of printing only the default:
+
+```mdx
+- Default instance: `https://accounts.conductor.one/auth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
+```
+
+Lead into the pair with wording that tells the reader how to choose — "whichever matches your C1 tenant's domain" — rather than assuming they already know which hosting option they're on. This applies even when the value is tenant-specific (contains a placeholder like `<tenantName>` or `YOUR_DOMAIN`): show both domain suffixes, not just `conductor.one`.
+
+Don't use this pattern for a value the reader copies directly from their own C1 account (for example, an MCP server URL shown on an "AI connections" page) — the product already displays the tenant's real, region-correct value, so there's nothing to disambiguate.
+
+**Reference and example-heavy pages** (API docs, CLI docs, service-principal/workload-federation guides) where `conductor.one` appears repeatedly inside code blocks or curl examples — don't rewrite every example. Add one callout near the section the examples belong to instead:
+
+```mdx
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+```
+
+- Place the callout immediately before the section whose examples it covers, not at the top of the page if the examples don't start until much later — "these examples" should mean the ones the reader is about to see.
+- If a page has more than one cluster of examples separated by unrelated content, repeat the callout at each cluster rather than relying on one mention to cover the whole page.
+- Reserve this pink `<Callout>` (`icon="globe"`, `color="#c937ae"`) for hosting-region notes specifically. Standard content notes still use `<Note>`, `<Tip>`, `<Warning>`, or `<Info>`.
+
+**Choosing between the two**: is this a single value the reader picks once and pastes into a form field or config (dual-value), or a domain suffix baked into many illustrative examples across a section (callout)? A page can need both — a one-time setup step plus a pile of reference examples further down.
+
 ## Navigation (docs.json)
 
 - Pages map to MDX files (no extension)

baton/aws.mdx

@@ -2,7 +2,7 @@
 title: "Set up an AWS connector"
 description: "C1 provides identity governance for AWS. Integrate your AWS instance with C1 to run user access reviews (UARs) and enable just-in-time (JIT) access requests."
 og:title: "Set up an AWS connector"
 og:description: "C1 provides identity governance for AWS. Integrate your AWS instance with C1 to run user access reviews (UARs) and enable just-in-time (JIT) access requests."
 sidebarTitle: "AWS"
 ---
 
@@ -42,7 +42,7 @@
 approved, short-lived AWS credential vending. C1 supplies a request-scoped OIDC
 token and age encryption recipient. The connector exchanges the token with AWS
 STS, encrypts the returned credential envelope before it crosses the connector
 boundary, and returns ciphertext plus expiration and assumed-role audit
 metadata.
 
 The action accepts:
@@ -69,7 +69,7 @@
 topology from its configured issuance mode and apply the corresponding AWS
 limit.
 
 ## Sparse ACLs: Organizations and permission sets as scoped bindings
 
 When both **Enable support for AWS Organizations** and **Enable support for AWS IAM Identity Center** are turned on, the connector also models Identity Center permission set assignments as **Sparse ACL** bindings, alongside the existing flat per-account entitlement model. This introduces four resource types:
 
@@ -114,7 +114,7 @@
 
 To sync IAM data (like users, roles, and groups) from multiple AWS child accounts, C1 uses a secure, read-only mechanism called **cross-account access**. This setup works by allowing a central role in your root account to temporarily assume a specific role in each child account. This method ensures that the connector can gather the necessary data without storing credentials or requiring permanent access.
 
 If you're using this setup, make sure to click **Enable support for AWS Organizations** when setting up the connector in the C1 web UI. You may also enable **Enable support for AWS IAM Identity Center** at the same time. By default, enabling Identity Center alongside Organizations syncs only Identity Center data (users, groups, permission sets, account assignments) and skips cross-account IAM. To also sync IAM users, roles, and groups from every child account in this combined mode, additionally enable **Also sync cross-account IAM when Identity Center is enabled**. This flag is off by default so existing Identity Center deployments don't suddenly require child-account `sts:AssumeRole` access.
 
 **In order to use the connector to gather IAM AWS data, you'll need to configure each sub-account to have a role with a trust policy.** There are two options here:
 
@@ -135,7 +135,7 @@
     </Step>
     <Step>
     Choose how to set up the new AWS connector:
 	- Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 	- Add the connector to a managed app (select from the list of existing managed apps)
 	- Create a new managed app
     </Step>
@@ -347,7 +347,7 @@
     </Step>
     <Step>
     Choose how to set up the new AWS connector:
 	- Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
 	- Add the connector to a managed app (select from the list of existing managed apps)
 	- Create a new managed app
     </Step>
@@ -776,7 +776,7 @@
 
 <Steps>
     <Step>
     Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
     </Step>
     <Step>
     Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the AWS connector to. AWS data should be found on the **Entitlements** and **Accounts** tabs.
@@ -794,10 +794,7 @@
 
 <Steps>
     <Step>
-    Log into [C1](https://accounts.conductor.one/accounts).
-    </Step>
-    <Step>
-    Click **Connectors** > **AWS Connector**.
+    In C1, click **Connectors** > **AWS Connector**.
     </Step>
     <Step>
     Copy and save the **External ID** populated in the **External ID** field. We'll use this in Step 2.

baton/azure-devops.mdx

@@ -2,7 +2,7 @@
 title: "Set up a Microsoft Azure DevOps connector"
 og:title: "Set up a Microsoft Azure DevOps connector"
 description: "C1 provides identity governance and just-in-time provisioning for Microsoft Azure DevOps. Integrate your Azure DevOps instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 og:description: "C1 provides identity governance and just-in-time provisioning for Microsoft Azure DevOps. Integrate your Azure DevOps instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 sidebarTitle: "Microsoft Azure DevOps"
 ---
 
@@ -24,27 +24,27 @@
 
 The Azure DevOps connector supports [automatic account provisioning](/product/admin/account-provisioning).
 
 This connector does not support account deprovisioning. You must deprovision accounts directly in Azure DevOps.
 
 Some Azure DevOps groups are managed in Microsoft Entra (formerly Azure AD),
 not in Azure DevOps. These groups appear in Azure DevOps and their members are
 visible, but membership changes are made in Entra.
 
 For Entra-managed groups, the connector accepts add and remove requests and
 reports them as successful without changing membership in Azure DevOps or
 Entra. These groups are assumed to be managed elsewhere — in the Entra admin
 center, through another C1 connector that integrates with Entra, or by another
 process. Reporting requests as successful prevents access reviews and
 just-in-time access requests from stalling on changes the connector does not
 perform.
 
 To have C1 manage Entra group membership through this connector, enable
 **Entra group membership provisioning** during setup. Requirements:
 
 - OAuth or client secret authentication. Personal Access Tokens do not support
   changes to Entra group membership.
 - The `GroupMember.ReadWrite.All` Microsoft Graph application permission on the
   Entra app registration, with admin consent in the tenant.
 
 See [Configure the Azure DevOps connector](#configure-the-azure-devops-connector) below for setup steps.
 
@@ -97,7 +97,10 @@
   Give the new app a name and select the **Accounts in any organizational directory** option.
   </Step>
   <Step>
-  Enter `https://accounts.conductor.one/oauth/callback` as a **Web** redirect URI.
+  Enter whichever redirect URI matches your C1 tenant's domain as a **Web** redirect URI:
+
+  - Default instance: `https://accounts.conductor.one/oauth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
   </Step>
   <Step>
   Click **Register**.
@@ -138,14 +141,14 @@
   Click **Add permissions**.
   </Step>
   <Step>
   **Optional — only required for Entra group membership provisioning.**
 
   If you want C1 to grant and revoke memberships on Entra-sourced Azure DevOps
   groups (descriptor prefix `aadgp.`), grant this same Entra app the **Microsoft
   Graph** application permission **`GroupMember.ReadWrite.All`** with admin
   consent.
 
   In the Entra portal, on this app registration:
 
   1. Click **API permissions** > **Add a permission**.
   2. Choose **Microsoft Graph** (not Azure DevOps).
@@ -156,7 +159,7 @@
 
   This is the least-privilege Microsoft Graph permission for member-only
   writes; the broader `Group.ReadWrite.All` is not required. Without it,
   Entra group membership provisioning will fail with a clear "missing
   GroupMember.ReadWrite.All" error at the first grant or revoke attempt.
   </Step>
   <Step>
@@ -171,14 +174,14 @@
 <Note>
 This option authenticates as a service principal using the OAuth 2.0 client
 credentials grant — no user interaction required. It supports all sync
 capabilities including PAT sync, license sync, and account provisioning. Entra
 group membership provisioning is also supported when the SP holds the
 `GroupMember.ReadWrite.All` Microsoft Graph permission.
 </Note>
 
 <Steps>
   <Step>
   In the [Microsoft Entra admin center](https://entra.microsoft.com), navigate to **App registrations** and click **New registration**.
   </Step>
   <Step>
   Give the app a name, select **Accounts in this organizational directory only**, leave the redirect URI blank, and click **Register**.
@@ -190,10 +193,10 @@
   Click **Certificates & secrets** > **New client secret**. Set a description and expiry, then click **Add**. Copy and save the secret **Value** immediately — it is not shown again.
   </Step>
   <Step>
   **No Azure DevOps API permission is required.** Azure DevOps does not expose application permissions in Entra — for the Azure DevOps API the **Application permissions** option is disabled, and the service principal does not need one. The connector uses the OAuth 2.0 client credentials grant against the Azure DevOps resource; the service principal is authorized by being added to your organization in the steps below.
   </Step>
   <Step>
   **Optional — only required for Entra group membership provisioning.**
 
   Click **API permissions** > **Add a permission** > **Microsoft Graph** > **Application permissions** > select **`GroupMember.ReadWrite.All`** > click **Add permissions**. Then click **Grant admin consent for &lt;tenant&gt;** and confirm — the status column must show a green checkmark.
   </Step>
@@ -210,7 +213,7 @@
 ### Option 3: Create a personal access token
 
 <Note>
 Personal Access Token authentication does **not** support Entra group
 membership provisioning. With PAT auth, grant and revoke requests against
 Entra-sourced groups (descriptor prefix `aadgp.`) are silent no-ops — the
 connector accepts the request and returns success without making any API
@@ -278,7 +281,7 @@
   </Step>
   <Step>
   Choose how to set up the new Azure DevOps connector:
     - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
     - Add the connector to a managed app (select from the list of existing managed apps)
     - Create a new managed app
   </Step>
@@ -299,7 +302,7 @@
     2. **Optional.** Check the boxes if you want to **Sync teams** or **Sync organizations**.
     3. **Optional.** Check **Enable incremental sync** to allow the connector to read audit logs and capture updates between full syncs. Requires the **Audit Log: Read** permission.
     4. **Optional.** Check **Enable legacy group identity resolution** to process legacy group audit events. This setting defaults to off and requires `vso.identity`.
     5. **Optional.** Check **Enable Entra group membership provisioning** to grant and revoke memberships on Entra-sourced groups via Microsoft Graph. Requires the `GroupMember.ReadWrite.All` Microsoft Graph application permission with admin consent. Per Microsoft, changes may take up to 1 hour to appear in the Azure DevOps Members view.
     6. **Optional.** Check **Use project RBAC roles** to enable the Sparse ACL model for project access. Project-scoped groups are also synced as structured Project Role Assignment resources, with role and project context visible on each entitlement. See [Project RBAC](#project-rbac) for details.
     7. Click **Save**.
     8. Click **Login with OAuth**.
@@ -351,7 +354,7 @@
   </Step>
   <Step>
   Choose how to set up the new Azure DevOps connector:
     - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
     - Add the connector to a managed app (select from the list of existing managed apps)
     - Create a new managed app
   </Step>
@@ -542,7 +545,7 @@
 
 <Steps>
   <Step>
   Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
   </Step>
   <Step>
   Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Azure DevOps connector to. Azure DevOps data should be found on the **Entitlements** and **Accounts** tabs.

baton/dropbox.mdx

@@ -2,7 +2,7 @@
 title: "Set up a Dropbox connector"
 og:title: "Set up a Dropbox connector"
 description: "C1 provides identity governance and just-in-time provisioning for Dropbox. Integrate your Dropbox HCM instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 og:description: "C1 provides identity governance and just-in-time provisioning for Dropbox. Integrate your Dropbox HCM instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 sidebarTitle: "Dropbox"
 ---
 
@@ -41,12 +41,12 @@
 
 ### Connector actions
 
 Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the [Perform connector action](/product/admin/automations-steps-reference#perform-connector-action) automation step.
 
 | Action name | Additional fields | Description |
 |-------------|-------------------|-------------|
 | enable_user | `user_id` (string, required) | Enables a user's access to Dropbox Team (unsuspends the account) |
 | disable_user     | `user_id` (string, required) | Disables a user's access to Dropbox Team (suspends the account) |
 
 <Warning>
 Disabling a Dropbox account will wipe the account's data on linked devices. Ensure this behavior is acceptable before running the action.
@@ -96,11 +96,10 @@
   Carefully copy and save the app key and app secret.
   </Step>
   <Step>
-  Under **OAuth 2**, add the following redirect URI and click **Add**:
+  Under **OAuth 2**, add whichever redirect URI matches your C1 tenant's domain, and click **Add**:
 
-  ```
-  https://accounts.conductor.one/oauth/callback
-  ```
+  - Default instance: `https://accounts.conductor.one/oauth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
   </Step>
   <Step>
   Give the app the relevant set of permissions:
@@ -179,7 +178,7 @@
   </Step>
   <Step>
   Choose how to set up the new Dropbox connector:
     - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
     - Add the connector to a managed app (select from the list of existing managed apps)
     - Create a new managed app
   </Step>
@@ -240,7 +239,7 @@
   </Step>
   <Step>
   Choose how to set up the new Dropbox connector:
     - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
     - Add the connector to a managed app (select from the list of existing managed apps)
     - Create a new managed app
   </Step>
@@ -328,7 +327,7 @@
 
 <Steps>
   <Step>
   Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
   </Step>
   <Step>
   Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Dropbox connector to. Dropbox data should be found on the **Entitlements** and **Accounts** tabs.

baton/freshbooks.mdx

@@ -39,7 +39,10 @@
     - user:account:write
 </Step>
 <Step>
-Enter `https://accounts.conductor.one/oauth/callback` as the **Redirect URI**.
+Enter whichever redirect URI matches your C1 tenant's domain as the **Redirect URI**:
+
+- Default instance: `https://accounts.conductor.one/oauth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
 </Step>
 <Step>
 Save the app. 
@@ -110,7 +113,7 @@
 <Step>
 Choose how to set up the new FreshBooks connector: 
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -165,7 +168,7 @@
 <Step>
 Choose how to set up the new FreshBooks connector: 
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -250,7 +253,7 @@
 ### Step 3: Deploy the connector
 <Steps>
 <Step>
 Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files. 
 </Step>
 <Step>
 Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the FreshBooks connector to. FreshBooks data should be found on the **Entitlements** and **Accounts** tabs.

baton/ironclad.mdx

@@ -2,7 +2,7 @@
 title: "Set up an Ironclad connector"
 og:title: "Set up an Ironclad connector"
 description: "C1 provides identity governance for Ironclad. Integrate your Ironclad instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 og:description: "C1 provides identity governance for Ironclad. Integrate your Ironclad instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 sidebarTitle: "Ironclad"
 ---
 
@@ -17,7 +17,7 @@
 
 When a new account is created by C1, the account's password will be sent to a [vault](/product/admin/vaults).
 
 This connector does not support account deprovisioning. You must deprovision accounts directly in Ironclad.
 
 ## Gather Ironclad credentials 
 
@@ -49,7 +49,10 @@
    - **Authorization Code**: Requires logging in and authorizing. Only available for cloud-hosted connectors.
 </Step>
 <Step>
-If you selected **Authorization Code**, enter `https://accounts.conductor.one/oauth/callback` in the **Redirect URI** field.
+If you selected **Authorization Code**, enter whichever redirect URI matches your C1 tenant's domain in the **Redirect URI** field:
+
+- Default instance: `https://accounts.conductor.one/oauth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
 </Step>
 <Step>
 In the **Scopes** area, give the app the following scopes:
@@ -93,7 +96,7 @@
 <Step>
 Choose how to set up the new Ironclad connector:
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -160,7 +163,7 @@
 <Step>
 Choose how to set up the new Ironclad connector:
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -252,7 +255,7 @@
 
 <Steps>
 <Step>
 Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
 </Step>
 <Step>
 Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Ironclad connector to. Ironclad data should be found on the **Entitlements** and **Accounts** tabs.

baton/lucidchart.mdx

@@ -1,8 +1,8 @@
 ---
 title: "Set up a Lucidchart connector"
 og:title: "Set up a Lucidchart connector"
 description: "C1 provides identity governance and just-in-time provisioning for Lucidchart. Integrate your Lucidchart instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 og:description: "C1 provides identity governance and just-in-time provisioning for Lucidchart. Integrate your Lucidchart instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 sidebarTitle: "Lucidchart"
 ---
 
@@ -14,27 +14,27 @@
 | Folders | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
 | Documents | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | 
 
 The Lucidchart connector supports [automatic account provisioning](/product/admin/account-provisioning). 
 
 *Account provisioning is only available on Lucidchart accounts with Enterprise licenses.
 
 When a new account is created by C1, the account's password will be sent to a [vault](/product/admin/vaults). 
 
 This connector does not support account deprovisioning. You must deprovision accounts directly in Lucidchart.
 
 ## Gather Lucidchart credentials 
 
 Each setup method requires you to pass in credentials generated in Lucidchart. Gather these credentials before you move on. 
 
 <Warning>
 A user with access to the **developer tools** in Lucidchart must perform this task.
 </Warning>
 
 ### Create an API key
 
 <Steps>
 <Step>
 In the Lucidchart developer portal, navigate to **API Keys**.
 </Step>
 <Step>
 Click **+ Create API Key**.
@@ -70,7 +70,10 @@
 Select the new app's **OAuth 2.0** tab.
 </Step>
 <Step>
-Enter `https://accounts.conductor.one/oauth/callback` in the **Redirect URI** field.
+Enter whichever redirect URI matches your C1 tenant's domain in the **Redirect URI** field:
+
+- Default instance: `https://accounts.conductor.one/oauth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
 </Step>
 <Step>
 Click **Create OAuth 2.0 client**.
@@ -82,14 +85,14 @@
 
 ### Self-hosted only: Create an OAuth refresh token
 
 If you're setting up a self-hosted Lucidchart connector, you'll also need a refresh token for the Lucidchart OAuth client.
 
 <Steps>
 <Step>
 Follow the [Lucidchart OAuth2 access token documentation](https://developer.lucid.co/reference/obtaining-an-access-token) to create an access token.
 </Step>
 <Step>
 If you want to use the Lucidchart connector to provision accounts, give the token the `account.user` scope.
 
    Account provisioning is only available on Lucidchart accounts with Enterprise licenses.
 </Step>
@@ -100,13 +103,13 @@
 
 **Done.** Next, move on to the connector configuration instructions. 
 
 ## Configure the Lucidchart connector
 
 <Warning>
 To complete this task, you'll need:
 
 - The **Connector Administrator** or **Super Administrator** role in C1
 - Access to the set of Lucidchart credentials generated by following the instructions above
 </Warning>
 
 <Tabs>
@@ -118,14 +121,14 @@
 In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
 </Step>
 <Step>
 Search for **Lucidchart** and click **Add**.
 
    **Don't see the Lucidchart connector?** Reach out to [support@c1.ai](mailto:support@c1.ai) to add Lucidchart to your **Connectors** page.
 </Step>
 <Step>
 Choose how to set up the new Lucidchart connector:
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -143,13 +146,13 @@
 Find the **Settings** area of the page and click **Edit**.
 </Step>
 <Step>
 Paste the API key in the **Lucidchart API key** field.
 </Step>
 <Step>
 Paste the client ID and client secret into the relevant fields.
 </Step>
 <Step>
 **Optional.** By default, the connector syncs Lucidchart documents and folders that are shortcuts. If you prefer not to sync shortcuts (because they don't grant effective permissions or might return 403/404 errors from the API), click to enable **Exclude shortcuts**.
 </Step>
 <Step>
 Click **Save**.
@@ -158,7 +161,7 @@
 Click **Login with OAuth**.
 </Step>
 <Step>
 Log into Lucidchart and authorize C1.
 </Step>
 <Step>
 After authorizing, you'll be redirected back to the C1 integrations page, where an "Authorized as" message is now printed.
@@ -168,11 +171,11 @@
 </Step>
 </Steps>
 
 **Done.** Your Lucidchart connector is now pulling access data into C1.
 </Tab>
 
 <Tab title="Self-hosted">
 **Follow these instructions to use the Lucidchart connector, hosted and run in your own environment.**
 
 When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.
 
@@ -180,7 +183,7 @@
 
 * [GitHub repository](https://github.com/conductorone/baton-lucidchart): Access the source code, report issues, or contribute to the project.
 
 ### Step 1: Configure the Lucidchart connector
 
 <Steps>
 <Step>
@@ -190,9 +193,9 @@
 Search for **Baton** and click **Add**.
 </Step>
 <Step>
 Choose how to set up the new Lucidchart connector:
 
    - Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 
    - Add the connector to a managed app (select from the list of existing managed apps)
 
@@ -218,7 +221,7 @@
 
 ### Step 2: Create Kubernetes configuration files
 
 Create two Kubernetes manifest files for your Lucidchart connector deployment:
 
 #### Secrets configuration
 
@@ -286,14 +289,14 @@
 
 <Steps>
 <Step>
 Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
 </Step>
 <Step>
 Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Lucidchart connector to. Lucidchart data should be found on the **Entitlements** and **Accounts** tabs.
 </Step>
 </Steps>
 
 **Done.** Your Lucidchart connector is now pulling access data into C1.
 </Tab>
 </Tabs>
 

baton/v1/aws.mdx

@@ -1,8 +1,8 @@
 ---
 title: "📜 Amazon Web Services (AWS) integration"
 og:title: "Set up AWS connector - C1 docs"
 og:description: Integrate your AWS instance with C1 to run user access reviews, enable just-in-time (JIT) access requests, and easily provision and deprovision access.
 description: C1 provides identity governance for AWS. Integrate your AWS instance with C1 to run user access reviews (UARs) and enable just-in-time (JIT) access requests.
 sidebarTitle: "AWS"
 ---
 
@@ -136,7 +136,7 @@
 </Step>
 
 <Step>
 _Skip_ **Add permissions** and click **Next**.
 </Step>
 
 <Step>
@@ -230,10 +230,7 @@
 
 <Steps>
 <Step>
-Log into [C1](https://accounts.conductor.one/accounts).
-</Step>
-<Step>
-Navigate to **Integrations** > **Connectors** > **AWS Connector**.
+In C1, navigate to **Integrations** > **Connectors** > **AWS Connector**.
 </Step>
 <Step>
 Copy and save the **External ID** populated in the **External ID** field (we'll use this in Step 2.

conductorone-api/authenticate.mdx

@@ -3,6 +3,8 @@
 description: "To use the C1 API, you must authenticate your requests. This document guides you through the process of obtaining and utilizing an API key, as well as establishing an access token."
 ---
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Step 1: Obtain an API key
 
 The first step in the process is to obtain your API key from C1:
@@ -21,7 +23,7 @@
 Set the API key's lifespan. Select from 30 days, 90 days, or never expires.
 </Step>
 <Step>
 If necessary, limit the source IPs the API key can be used from by entering one or more CIDR blocks in the **Allowed IPs** field.
 </Step>
 <Step>
 Select the scope of permissions for the API key. You can choose either **Full Permissions** or select specific roles to assign to the API key.
@@ -37,7 +39,7 @@
 
 ### Details about the Client ID and Client Secret
 
 The Client ID is a stable format that includes a random ID, the base hostname, and the use-case. It is represented in the format: `<random-id>@<hostname>/<use-case>`. For example: `strange-hydra-68836@acme.conductor.one/pcc`.
 
 The Client Secret follows the format: `secret-token:conductorone.com:${base64url encoded JWK}`. It contains an `ed25519` private key that you may parse to get the private key. For example:
 
@@ -51,20 +53,20 @@
 
 A crucial part of interacting with the C1 API involves determining the appropriate endpoints for your requests. Two key components in this process are your API root and the token endpoint. These can be inferred from your Client ID.
 
 ### Extracting the hostname from the Client ID
 
 
 Your Client ID is in the format `<random-id>@<hostname>/<use-case>`. The hostname for your API client can be identified as the portion of your Client ID immediately following the `@` and preceding the `/`.
 
 For instance, for the Client ID `strange-hydra-68836@acme.conductor.one/pcc`, the hostname is `acme.conductor.one`.
 
 ### Identifying the token endpoint
 
 With the hostname in hand, the token endpoint can be determined. It resides under the hostname at the path `/auth/v1/token`. So for the example Client ID above, the token endpoint is `https://acme.conductor.one/auth/v1/token`.
 
 ### Identifying the API root
 
 Similar to the token endpoint, the API root is also located under the hostname. It resides at the path `/api/v1`. In our example Client ID, the API root is `https://acme.conductor.one/api/v1`.
 
 ## Step 3: Get an access token
 
@@ -84,7 +86,7 @@
 - `client_id=${CLIENT_ID}`
 - `client_secret=${CLIENT_SECRET}`
 
 You will receive a JSON response which includes an an `access_token`, `token_type`, and an `expires_in` value that indicates the number of seconds until the access token expires.
 
 Example JSON response:
 
@@ -143,10 +145,10 @@
 
 Here are the key requirements for the signed JWT:
 
 - The issuer (iss) should be set to the `${CLIENT_ID}` value.
 - The subject (sub) should be set to the `${CLIENT_ID}` value.
 - The audience (aud) should be set to the Tenant's Domain.
 - The expiration time (exp) of the JWT must be within five minutes of the current time. Infinitely valid JWTs are not allowed.
 
 To authenticate using a signed client assertion, you should POST a request to `${TOKEN_ENDPOINT}` using the `application/x-www-form-urlencoded` content type with the following data:
 

conductorone-api/pagination.mdx

@@ -3,9 +3,11 @@
 description: "When making `LIST` or `SEARCH` requests to the C1 API, use the `page_size` and `page_token` parameters to navigate through the list of results."
 ---
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Using page\_size
 
 Include the `page_size` parameter to tell the API how many search or list results to show on each page.
 
 **`page_size` accepts a number between 10 and 100.**
 
@@ -15,7 +17,7 @@
 
 ## Using page\_token
 
 If your query returns more results than will fit on one page of the size you specified with `page_size`, you'll see a unique `nextPageToken` value at the bottom of the response. Include this value with the `page_token` parameter in your next request to see the next page of results.
 
 You do not need to include `page_token` in your initial request (or you can include it but leave it empty), but you must do so for each subsequent request.
 

product/admin/c1-mcp.mdx

@@ -78,9 +78,11 @@
 </Steps>
 
 <Note>
 If you configure IP restrictions, AI assistants will only work from the specified IP ranges. This is useful for restricting usage to corporate networks or VPNs.
 </Note>
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Connect an AI assistant
 
 Follow these steps to connect your AI assistant to C1 via MCP.
@@ -108,7 +110,7 @@
     4. Save and restart Claude Desktop.
   </Tab>
   <Tab title="Claude Code">
     1. From your terminal, add the C1 MCP server using the `claude mcp add` command:
 
        ```bash
        claude mcp add --transport http c1 https://<your-tenant>-mcp.conductor.one/v1
@@ -124,7 +126,7 @@
     </Tip>
   </Tab>
   <Tab title="Codex">
     1. From your terminal, add the C1 MCP server using the `codex mcp add` command:
 
        ```bash
        codex mcp add c1 --url https://<your-tenant>-mcp.conductor.one/v1
@@ -184,7 +186,7 @@
 | `describe_object_filters` | Get filterable fields for an object type |
 | `get_object_schema` | Get the JSON schema for an object type |
 
 ## Queryable objects
 
 AI assistants can query 20 different object types across your C1 tenant.
 
@@ -227,7 +229,7 @@
 
 | Object | Description |
 | :--- | :--- |
 | `RequestCatalog` | Collections of requestable entitlements in an Access Profile |
 | `Webhook` | Event notification configurations |
 | `Directory` | Account sync configurations |
 | `ProfileType` | Attribute mapping configurations |
@@ -393,7 +395,7 @@
   </Accordion>
 
   <Accordion title="How do I restrict where AI connections can be used?">
     Administrators can configure IP allow lists in **Settings** > **IP Allowlist** > **AI connections** to restrict access to specific IP ranges. This is useful for limiting usage to corporate networks or VPNs.
   </Accordion>
 
   <Accordion title="Can I see what queries the AI is making?">

product/admin/code-mode.mdx

@@ -73,7 +73,7 @@
 
 ### One program per call
 
 Each `execute` call deploys an ephemeral function, while `tools.X()` calls inside the running program are fast. An agent that needs six tool calls should write one program that makes all six, not six `execute` calls. Dependent calls become sequential `await`s; independent lookups go in a `Promise.all()`.
 
 ### Example: paginate a large result set
 
@@ -96,6 +96,8 @@
 
 Response shapes differ from tool to tool. The `records` and `nextPageToken` keys above belong to this tool; read the real keys from `describe` output rather than carrying an envelope key over from a different tool. Optional keys should be omitted entirely — never passed as `undefined`.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Reading the results
 
 Most calls return what you'd expect: the upstream tool's normal output, minus anything a post-tool-use hook redacted or capped.
@@ -117,7 +119,7 @@
 }
 ```
 
 The tool is requestable but not yet granted, so C1 opened an access request on the caller's behalf. **The upstream API was not called.** Approval runs through the tool's normal policy — manager approval and the rest — and once the grant lands, the same call executes.
 
 ```json
 {
@@ -138,7 +140,7 @@
 
 A program that runs past the synchronous wait window of roughly 25 seconds doesn't fail. `execute` returns `{ "status": "pending", "execution_id": "..." }` and the program keeps running server-side.
 
 The agent then polls `get_execution` with that `execution_id`. Each response carries a `status` of `pending`, `running`, `success`, or `error`, plus the full output and logs once the program finishes either way. Poll with exponential backoff — 1 second, then 2, 4, 8, 16, 30, capped at 30 seconds — and do other independent work in between rather than polling in a tight loop.
 
 Executions are capped at 15 minutes total; the polling response reports elapsed and remaining time. The `execution_id` is opaque and scoped to the calling session's tenant and principal, so it's useful for the polling loop and nothing beyond it.
 

product/admin/enterprise-managed-authorization/overview.mdx

@@ -84,10 +84,12 @@
 1. [Enable enterprise-managed authorization](/product/admin/enterprise-managed-authorization/enable) for your tenant and choose a signing algorithm.
 2. [Register the MCP server](/product/admin/enterprise-managed-authorization/resource-servers).
 3. [Discover or declare the server's scopes, enable the ones you want to expose, and bundle them into access profiles](/product/admin/enterprise-managed-authorization/scopes-and-profiles) so users can request them.
 4. Users [request access](/product/admin/access-requests) through the standard C1 catalog, and approvers grant it.
 
 Before you start, the MCP server's authorization server must be configured to trust C1 as an issuer. That work is done by the server's owner — see [Support enterprise-managed authorization in your MCP server](/product/admin/enterprise-managed-authorization/support-in-your-app).
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Key concepts
 
 | Concept | Description |

product/admin/enterprise-managed-authorization/support-in-your-app.mdx

@@ -21,6 +21,8 @@
 
 C1 issues an ID-JAG, a short-lived JWT whose audience is your authorization server's issuer. Your authorization server verifies C1's signature, confirms the token is meant for it, and returns one of your own access tokens that the agent then uses to call your API.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Trust C1 as an issuer
 
 Configure your authorization server to recognize C1 as a token issuer and to advertise the grant C1 relies on.
@@ -87,6 +89,8 @@
 
 C1 can sign ID-JAGs with ES256 (the default), RS256, or EdDSA. Pick the algorithm your authorization server verifies, and tell your C1 admin which one to use for your system. C1 uses the chosen algorithm with no silent fallback, so the algorithm your admin configures must be one your authorization server accepts.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Example
 
 The following are taken from a verified end-to-end exchange against a live C1 tenant. The protected-resource metadata document shows the fields C1 reads during discovery, and the decoded ID-JAG shows the claims your authorization server verifies.

product/admin/functions-api.mdx

@@ -8,6 +8,8 @@
 
 Manage functions programmatically through the C1 REST API to automate deployments or work outside the web UI. For the web UI workflow, see [Create and test functions](/product/admin/functions-create).
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Authentication
 
 All API calls require a bearer token from a personal API key or service principal credential. See [C1 API and keys](/conductorone-api/api) for setup.

product/admin/mcp-server/bitbucket.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Bitbucket MCP server lets you govern access to Bitbucket Cloud — repositories, pull requests, issues, pipelines, projects, and workspace data — as tools your AI clients can call through C1.
@@ -54,7 +54,9 @@
 Fill in the registration form:
 
 - **Name** — a recognizable name such as `C1`.
-- **Callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`.
+- **Callback URL** — set this exactly to whichever matches your C1 tenant's domain:
+  - Default instance: `https://accounts.conductor.one/auth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Under **Permissions**, grant only the scopes you need for the operations you plan to govern, such as read access to Account, Repositories, Pull requests, and Issues.
@@ -124,11 +126,11 @@
 
 ### Create an API token
 
 Create an API token in your Atlassian account so C1 can authenticate to the Bitbucket API.
 
 <Steps>
 <Step>
 In your Atlassian account settings, create an **API token** scoped for Bitbucket access. For details, see Bitbucket's [API tokens](https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/) documentation.
 </Step>
 <Step>
 Copy the generated token. Treat it as a high-value credential.
@@ -168,7 +170,7 @@
 
 Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Bitbucket tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Bitbucket credentials when an approved user successfully calls a Bitbucket tool from their AI client.

product/admin/mcp-server/box.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Box MCP server lets you govern access to Box — files, folders, users, groups, and other content data — as tools your AI clients can call through C1.
@@ -48,7 +48,10 @@
 Give the app a recognizable name such as `C1`.
 </Step>
 <Step>
-In the app's configuration, set the **redirect URI** exactly to `https://accounts.conductor.one/auth/callback`.
+In the app's configuration, set the **redirect URI** exactly to whichever matches your C1 tenant's domain:
+
+- Default instance: `https://accounts.conductor.one/auth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Grant only the scopes you need, such as read access to the content you plan to govern. Copy the **client ID** and **client secret**.
@@ -102,7 +105,7 @@
 
 Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Box tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Box credentials when an approved user successfully calls a Box tool from their AI client.

product/admin/mcp-server/confluence.mdx

@@ -9,12 +9,12 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Confluence MCP server lets you govern access to Confluence Cloud — pages, blog posts, spaces, comments, attachments, whiteboards, groups, and users — as tools your AI clients can call through C1.
 
 Confluence uses per-user OAuth, which is recommended: each person authorizes with their own Atlassian account, so every tool call runs under that user's identity and permissions.
 
 ## How C1 connects to Confluence
 
@@ -25,19 +25,19 @@
 ## Before you begin
 
 - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
 - An Atlassian account that can create an OAuth 2.0 integration. See Atlassian's [OAuth 2.0 (3LO) apps guide](https://developer.atlassian.com/cloud/confluence/oauth-2-3lo-apps/).
 
 <Note>
 If you don't see **Confluence** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
 </Note>
 
 ## Create an Atlassian OAuth 2.0 integration
 
 With per-user OAuth, you register one Atlassian OAuth 2.0 (3LO) integration and each user authorizes individually. This keeps every action attributable to the user who took it, with only the access that user already has in Confluence.
 
 <Steps>
 <Step>
 Sign in to the Atlassian Developer Console with your Atlassian account. For the full walkthrough, see Atlassian's [OAuth 2.0 (3LO) apps guide](https://developer.atlassian.com/cloud/confluence/oauth-2-3lo-apps/).
 </Step>
 <Step>
 Select **Create** > **OAuth 2.0 integration**, enter a recognizable name such as `C1`, then select **Create**.
@@ -46,11 +46,10 @@
 Open the **Permissions** tab. Next to **Confluence API**, select **Add**, then **Configure**, and add the scopes from [Confluence scopes](#confluence-scopes) below — the default read scopes, plus any optional write or delete scopes you need.
 </Step>
 <Step>
-Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to:
+Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to whichever matches your C1 tenant's domain:
 
-```
-https://accounts.conductor.one/auth/callback
-```
+- Default instance: `https://accounts.conductor.one/auth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 
 Select **Save changes**.
 </Step>
@@ -74,12 +73,12 @@
 *Delete:* `delete:attachment:confluence`, `delete:comment:confluence`, `delete:custom-content:confluence`, `delete:database:confluence`, `delete:embed:confluence`, `delete:folder:confluence`, `delete:page:confluence`, `delete:whiteboard:confluence`
 
 <Note>
 Atlassian recommends keeping an app under 50 scopes. Scope changes take effect the next time a user connects — adding an optional scope after users have connected requires each user to reconnect their Atlassian account.
 </Note>
 
 ## How Confluence credentials are shared
 
 With per-user OAuth, each user authorizes with their own Atlassian account, so tool calls run under that user's Confluence identity and inherit only the access they already have. Atlassian attributes each action to the individual user.
 
 For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
 
@@ -95,7 +94,7 @@
 When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your integration's **client ID** and **client secret**.
 </Step>
 <Step>
 Save your changes. The first time a user calls a Confluence tool from their AI client, they're prompted to connect their Atlassian account.
 </Step>
 </Steps>
 
@@ -105,7 +104,7 @@
 
 Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Confluence tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Confluence credentials when an approved user successfully calls a Confluence tool from their AI client.
@@ -113,5 +112,5 @@
 
 ## Manage your Confluence credentials
 
 - **Rotate the OAuth client secret** in the Atlassian Developer Console under your integration's **Settings** tab, then update the secret on the server's authentication settings in C1.
 - **Adjust access** by editing the integration's Confluence scopes on the **Permissions** tab in the Atlassian Developer Console.

product/admin/mcp-server/gemini-enterprise.mdx

@@ -41,6 +41,8 @@
 - Someone who holds `roles/orgpolicy.policyAdmin` at the organization level. Project **Owner** does not include it, and a project-level grant is not sufficient for the policy change below.
 - **Optional.** The [gcloud CLI](https://cloud.google.com/sdk/docs/install), authenticated with `gcloud auth login`, if you prefer the command line for the Google Cloud steps.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Collect the values you'll reuse
 
 The steps below reuse these values. Collect them once.
@@ -156,6 +158,8 @@
 An app created this way has no subscription attached. Add one under **Manage users** in the console before you assign licenses.
 </Accordion>
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Allow custom MCP data connectors
 
 Google Cloud blocks custom MCP data connectors by default through the `constraints/discoveryengine.managed.disableCustomMcpServerConnector` organization policy. Turn it off for this project before you create the data store.
@@ -228,7 +232,7 @@
 
 If the constraint has never been set, this command returns `NOT_FOUND: Requested entity was not found`. That is the healthy answer and means nothing is restricting egress.
 
 If it does apply, allow the two hostnames your tenant uses. Use hostnames only, not full URLs. This is a boolean constraint that takes parameters, not a list of allowed values. Save this as `egress.yaml` and apply it with `gcloud org-policies set-policy egress.yaml`, keeping any hostnames your organization already allows:
 
 ```yaml
 name: projects/YOUR_PROJECT_ID/policies/discoveryengine.managed.allowedEgressFqdns
@@ -347,6 +351,8 @@
   }'
 ```
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Get the OAuth client ID
 
 Gemini Enterprise authenticates each user to C1 with the OAuth 2.0 authorization code flow, and it needs an OAuth client that already exists. It does not register one itself, and it does not publish a client identity you can point at.
@@ -463,6 +469,8 @@
 </Note>
 </Accordion>
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Create the data store
 
 Connect the C1 MCP gateway to your Gemini Enterprise app.
@@ -721,8 +729,10 @@
 
 The connection is working, and every tool call is attributed to the user who made it.
 
 If the agent does not call a tool, returns nothing, or reports a denial, see [Troubleshoot Gemini Enterprise connection errors](#troubleshoot-gemini-enterprise-connection-errors). A denial that names a missing toolset or access profile is C1 working as configured, not a broken integration.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Troubleshoot Gemini Enterprise connection errors
 
 | Symptom | Cause | Fix |
@@ -740,13 +750,13 @@
 | **Failed to reload custom actions** on a connector that is **Active** | The most common cause by far is that the signed-in user has never opened the Gemini Enterprise web app. | Open the web app as that user, then reload again. See [Sign in to the web app](#sign-in-to-the-web-app). |
 | **Failed to reload custom actions**, and the user has signed in | The connector is still creating, `discoveryengine.googleapis.com` is not enabled, the user holds no license, or no identity provider is set. | Wait for **Active**, then check each in turn. See [Prepare Gemini Enterprise](#prepare-gemini-enterprise). |
 | **Reload custom actions** shows no error and no actions | Most often the reload is still running. It takes about 30 seconds. | Wait for the **Custom actions reloaded** confirmation, then reload the page. |
 | The action list stays empty after the reload finishes | C1 returned an empty tool list for the authorizing user, which happens when that user has no toolset. | Assign the authorizing user an access profile that includes the tools you expect, then reload again. See [Tools and toolsets](/product/admin/tools-and-toolsets). |
 | The assistant answers that it has "no ConductorOne integration" | The user has not authorized the connector in the web app. Enabling actions authorizes nobody. | In the message box, open **Connectors** and select **Authorize** beside your connector. See [Verify the Gemini Enterprise connection](#verify-the-gemini-enterprise-connection). |
 | The assistant picks a web search instead of a C1 action | No enabled action matches the request, so nothing is callable. | Enable the actions the request needs, and name the connector in the prompt. |
 | A user's tool calls are denied while another user's succeed | C1 is enforcing that user's access profile. This is expected behavior. | Check the denial reason in the audit log. See [Audit AI tool usage](/product/admin/audit-ai-tool-usage). |
 | Authorization works, then breaks about an hour later | The connector uses a dynamically registered client whose secret expired. | Host a Client ID Metadata Document and use its URL as the client ID instead of registering dynamically. See [Get the OAuth client ID](#get-the-oauth-client-id). |
 | Tool calls fail immediately after a working **Verify Auth** | The token is not bound to your MCP endpoint. | Set **Authorization URL Parameters** to `&resource=https://<your-tenant>-mcp.conductor.one/v1`. |
 | `failed to fetch client metadata` | C1 fetches its own client metadata document over the public internet, and your tenant hostname does not resolve publicly. | This affects self-managed C1 deployments rather than C1 cloud tenants. [Contact the C1 support team](mailto:support@c1.ai). |
 
 <Note>
 To correct an authentication value, edit the existing connector's settings rather than recreating it. The connector name cannot be changed after creation, as noted in [Create the data store](#create-the-data-store), so changing it means creating a new data store and removing the old one.

product/admin/mcp-server/github.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-07-24 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 C1 can govern GitHub access two ways. Both let your AI clients read from and act on GitHub through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog:
@@ -25,7 +25,7 @@
 | **Tool surface** | GitHub's own tool set: repositories, issues, pull requests, Actions workflows, discussions, security alerts, and notifications | Repositories, pull requests, issues, Actions, and organization data, mapped to GitHub API endpoints |
 | **Setup effort** | Register a GitHub OAuth App (or generate a token), then register in C1 | Register a GitHub OAuth App (or generate a token), then register in C1 |
 
 Use the native **GitHub MCP** option (listed as plain **GitHub** in your catalog) if you want GitHub's own broader, agentic tool set, including cross-item search, discussions, and security alerts. Use **GitHub API** if you want C1's own curated tool surface mapped directly to GitHub API endpoints.
 
 <Tabs>
 
@@ -58,7 +58,9 @@
 
 - **Application name** — a recognizable name such as `C1`.
 - **Homepage URL** — your C1 tenant URL, or `https://www.c1.ai`.
-- **Authorization callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`. GitHub OAuth Apps allow only one callback URL, unlike GitHub Apps.
+- **Authorization callback URL** — set this exactly to whichever matches your C1 tenant's domain (GitHub OAuth Apps allow only one callback URL, unlike GitHub Apps):
+  - Default instance: `https://accounts.conductor.one/auth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Select **Register application**, then copy the **Client ID**. Select **Generate a new client secret** and copy the secret — GitHub shows it only once. Store it securely, and if it's ever exposed, generate a new one, update C1, then delete the old one ([best practices for creating an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/best-practices-for-creating-an-oauth-app)).
@@ -88,10 +90,10 @@
 - `read:user` and `user:email` — read access to the user's profile data and email addresses.
 - `read:packages` and `write:packages` — download/install and upload/publish access to GitHub Packages.
 - `read:project` and `project` — read-only and read/write access to user and organization projects.
 - `gist` — write access to gists.
 - `notifications` — read access to the user's notifications, plus mark-as-read and subscription management.
 - `workflow` — the ability to add and update GitHub Actions workflow files.
 - `codespace` — the ability to create and manage codespaces.
 
 Tool calls then run with the connected user's own GitHub permissions across whichever of these scopes they hold — for example, a user without `write:packages` can't publish a package through a GitHub tool even though C1 requested that scope.
 
@@ -125,7 +127,7 @@
 
 Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a GitHub tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if authentication isn't complete yet, so seeing discovered tools doesn't confirm a user has authorized. You confirm access when an approved user successfully calls a GitHub tool from their AI client.
@@ -167,7 +169,7 @@
 
 ### Create a GitHub OAuth app
 
 Register an OAuth app in GitHub so C1 can prompt each user to authorize with their own account. For the full walkthrough, see GitHub's [latest guide to creating an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app).
 
 <Steps>
 <Step>
@@ -178,7 +180,9 @@
 
 - **Application name** — a recognizable name such as `C1`.
 - **Homepage URL** — your C1 tenant URL, or `https://www.c1.ai`.
-- **Authorization callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`. GitHub OAuth apps allow only one callback URL.
+- **Authorization callback URL** — set this exactly to whichever matches your C1 tenant's domain (GitHub OAuth apps allow only one callback URL):
+  - Default instance: `https://accounts.conductor.one/auth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Select **Register application**.
@@ -210,7 +214,7 @@
 
 ### Create a personal access token
 
 Generate a fine-grained personal access token in GitHub for C1 to authenticate with. For the full walkthrough, see GitHub's [guide to creating a fine-grained personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-fine-grained-personal-access-token).
 
 <Steps>
 <Step>
@@ -260,7 +264,7 @@
 
 Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a GitHub tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your GitHub credentials when an approved user successfully calls a GitHub tool from their AI client.

product/admin/mcp-server/google-analytics-admin.mdx

@@ -9,7 +9,7 @@
 {/* Editor Refresh: 2026-06-11 */}
 
 <Note>
 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
 </Note>
 
 The Google Analytics Admin MCP server lets you govern access to Google Analytics 4 configuration — accounts, properties, data streams, custom dimensions, conversions, and account-level user permissions — as tools your AI clients can call through C1.
@@ -63,7 +63,10 @@
 Go to **APIs & Services** > **Credentials** > **Create Client** > **Web application**. For full details, see Google's [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257) documentation.
 </Step>
 <Step>
-Under **Authorized redirect URIs**, add exactly `https://accounts.conductor.one/auth/callback`.
+Under **Authorized redirect URIs**, add exactly whichever matches your C1 tenant's domain:
+
+- Default instance: `https://accounts.conductor.one/auth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Select **Create**, then copy the **Client ID** and **Client secret**. Google shows the client secret only once.
@@ -139,7 +142,7 @@
 
 Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
 
 Before anyone can call a Google Analytics Admin tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
 
 <Note>
 Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Google Analytics Admin credentials when an approved user successfully calls a Google Analytics Admin tool from their AI client.