> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Cornerstone with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a Cornerstone account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Cornerstone actions.

> [!WARNING]
>
> Ensure that your Cornerstone account has Admin privileges.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Generate Client ID and Secret key

To connect Cornerstone with StackOne, you'll need to register an OAuth 2.0 application in your Cornerstone portal.

**1. Register a new application**

Sign in to your [Cornerstone account](https://www.cornerstoneondemand.com), then open **Admin > Tools > Edge > API Management**. On the **Manage Applications** tab, click **Register New Application**.

**2. Enter Application Details**

Provide the required application information.

<ul>
  <li>**Application Name**: Enter a descriptive name (e.g., StackOne Integration)</li>
  <li>**User ID**: Enter the User ID of an active user in your portal</li>
</ul>

**3. Select Application Scopes**

Enables actions: Assign Training, Catalog Search, Complete Training, Create Express Class, Create Learning Object, Get Approvals, Get Assigned Trainings, Get Inbox Items, Get Learning Assignment, Get Learning Object Details, Get Remaining Assignment Count, Get Sessions, Get Suggested Trainings, Get Tasks, Get Transcript Curricula Child Details, Get Transcript Enhanced Details, Get Transcripts (Legacy), List Users, Search Learning Assignments, Search Transcripts, Update Transcript Progress

In the **Scopes** section, select the scopes you want to associate with your application. The scopes below are the ones this connector uses — select every scope for the actions you intend to call.

<ul>
  <li>
    training:read
  </li>

  <li>
    training:create
  </li>

  <li>
    obj\_users\_core:read
  </li>

  <li>
    learningassignment:read
  </li>

  <li>
    transcript:read
  </li>

  <li>
    transcript:create
  </li>

  <li>
    transcript:create:assign
  </li>

  <li>
    transcript:update
  </li>

  <li>
    transcript:update:complete
  </li>

  <li>
    transcript:update:progress
  </li>

  <li>
    approval:read
  </li>

  <li>
    inbox:read
  </li>

  <li>
    task:read
  </li>

  <li>
    expressclass:create
  </li>
</ul>

**4. Complete Registration**

Click **Register Application** to complete the registration process.

**5. Copy your Client ID and Client Secret**

If the User ID is valid, Cornerstone shows the **Client ID** and **Client Secret**. Copy both values and paste them into the **Client ID** and **Client Secret** fields when you connect your account.

<ul>
  <li>⚠️ The Client Secret will only be shown once and cannot be retrieved later. If lost, you'll need to regenerate it.</li>
</ul>

## Configure User Permissions

Ensure the user associated with your OAuth application has the necessary permissions.

**1. Navigate to User Management**

Navigate to **Admin > Tools > Core Functions > Users** and search for the user whose User ID you entered when you registered the application.

**2. Configure Permissions**

Click on **Options > Permissions**. Ensure the following permissions are configured to either `There are no constraints available for this permission.` or `Restrict to User's Corporation.`

<ul>
  <li>Reporting API - Read only</li>
  <li>Transcript API - Request</li>
  <li>Transcript API - View</li>
  <li>Employee API - View</li>
  <li>Learning Assignment API - View</li>
</ul>

## Find Your Company Domain

Your Company Domain is the subdomain part of your Cornerstone URL.

**1. Locate Domain in URL**

While signed in to your Cornerstone account, look at the URL in your browser. Enter only the subdomain part, without `.csod.com`, in the **Company Domain** field.

<ul>
  <li>Format: `{subdomain}` from `https://{subdomain}.csod.com`</li>
  <li>Example: `my-company` for `https://my-company.csod.com`</li>
</ul>

## Troubleshooting

Common issues and how to resolve them.

**1. Check API access if you see 'Provided user does not have Rest services permissions and/or constraints to perform this operation'**

This error message indicates that the API you are trying to access is not enabled in your Cornerstone portal. To resolve this error, follow these steps.

<ul>
  <li>Navigate to **Admin > Tools > Edge > Integrations > Manage APIs** within your Cornerstone portal.</li>
  <li>Ensure the toggles for **Cornerstone API** and **Reporting API** are turned on.</li>
  <li>If the toggles are already turned on, try turning them off and then back on again. This action resets the backend settings that control access to Cornerstone's APIs.</li>
  <li>After performing the above steps, if you still see the same error response, please log a case with Cornerstone Global Customer Support (GCS).</li>
</ul>

**2. Check Reporting API access if you get a 401 Unauthorized response**

There are a few things you should check when you receive this response.

<ul>
  <li>Verify that the Reporting API is enabled for the environment that you are trying to pull data from. Navigate to **Admin > Tools > Edge > API Management > Manage APIs**. You should see the Reporting API enabled on this page.</li>
  <li>**If using OAuth 2.0**: Ensure that the user account associated with your registered OAuth 2.0 application has the **Reporting API - Read only** permission.</li>
  <li>**If using OAuth 2.0**: Ensure that your OAuth 2.0 application has the required scope to access the endpoint that you are trying to retrieve data from.</li>
  <li>**If using OAuth 2.0**: Ensure that the OAuth 2.0 access token is still valid. Remember that OAuth 2.0 access tokens are valid for an hour by default, unless you set a different validity period for your application in the API Management page in Edge.</li>
  <li>After performing the above steps, if you still see an 'unauthorized access' error, please log a case with Cornerstone Global Customer Support (GCS).</li>
</ul>

## Link the Account

**1. Connect**

<ul>
  <li>Click **Connect**.</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup.</li>
</ul>

**2. Use Actions**

Connect an AI platform to the linked account's actions. See [AI Platforms](https://docs.stackone.com/ai-platforms/overview.md).

Other ways to call actions are listed in [Protocols & SDKs](https://docs.stackone.com/connect/protocols-and-sdks.md).

## Next Steps

> [card] [Webhooks setup](https://docs.stackone.com/connectors/cornerstone/guides/webhook-setup.md)
>
> Configure receiving Events for Cornerstone into StackOne.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.