> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-c1-ai-rename-baton.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Palantir connector

> C1.ai provides identity governance for Palantir Foundry. Integrate your Foundry stack with C1.ai for unified visibility and governance over user access.

C1.ai provides identity governance for Palantir Foundry. Integrate your Foundry
stack with C1.ai for unified visibility and governance over user access.

## Capabilities

| Resource | Sync                                                          | Provision                                                     |
| :------- | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Users    | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Groups   | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |

The Palantir connector syncs your Foundry users and groups, and the membership
of each group. It supports [provisioning](/product/admin/account-provisioning):
you can grant and revoke group membership for a user, and delete a user. User
provisioning is deprovisioning only: Foundry has no create-user API, so the
connector cannot create accounts. Deleting a user calls Foundry's delete-user
endpoint. What happens next depends on your Foundry configuration: if Foundry
hard-deletes the account, it no longer appears in the sync; if Foundry marks the
account deleted instead, it keeps syncing into C1.ai as a disabled account.

<Note>
  **A group can contain both users and other groups.** Nested-group members are
  surfaced as expandable grants, so a user who reaches a group only through a
  nested group still shows that access in C1.ai.
</Note>

## Gather Palantir credentials

<Warning>
  You need a Foundry token that carries the **admin read** and **admin write**
  permissions on the organizations you want to govern. Creating that token
  requires Foundry administrator access.
</Warning>

<Steps>
  <Step>
    Sign in to your Foundry stack as an administrator and note the stack URL
    (for example, `https://acme.palantirfoundry.com`).
  </Step>

  <Step>
    Create a token for the connector to authenticate with. Use either a
    personal access token or a service-user token from an OAuth2 client.
  </Step>

  <Step>
    Grant the token's principal the **admin read** and **admin write**
    permissions so it can read users and groups and manage group membership.
  </Step>

  <Step>
    Copy the stack URL and the token. You'll need both to configure the
    connector.
  </Step>
</Steps>

## Configure the Palantir connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.ai.

    <Steps>
      <Step>
        In C1.ai, navigate to **Apps** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Palantir** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Palantir connector.
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Palantir credentials:

        * **Base URL**: Your Foundry stack URL, for example `https://acme.palantirfoundry.com`.
        * **API token**: The token you created above.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Palantir connector is now pulling access data into C1.ai.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the Palantir connector in your own
    environment.

    <Steps>
      <Step>
        Create secrets for the Palantir credentials.
      </Step>

      <Step>
        Configure the connector environment variables:

        * **BATON\_BASE\_URL**: Your Foundry stack URL, for example `https://acme.palantirfoundry.com`.
        * **BATON\_API\_TOKEN**: The token you created above.
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your Palantir connector is now pulling access data into C1.ai.
  </Tab>
</Tabs>