Skip to main content
Creating an API token needs an Orca user who is allowed to create API tokens. Orca bases a service token’s permissions on the user who creates it, so create it as a user who can see users and role assignments.

​
Find your Orca region

The Region identifies which Orca data center your account runs in. An API token works only in the region it was created in.

  • Open Orca in your browser and read the address in the address bar.
  • app.orcasecurity.io: choose US Global (api.orcasecurity.io)
  • eu.app.orcasecurity.io: choose Europe (app.eu.orcasecurity.io)
  • au.app.orcasecurity.io: choose Australia (app.au.orcasecurity.io)
  • in.app.orcasecurity.io: choose India (app.in.orcasecurity.io)
  • app.sa.orcasecurity.io: choose South America (api.sa.orcasecurity.io)
  • us.app.orcasecurity.io: choose United States (app.us.orcasecurity.io)
  • app.id.orcasecurity.io (Indonesia) or us.gov.app.orcasecurity.io (GOV Cloud): no option matches, so this connection cannot reach accounts in these regions
  • Select the matching option in the Region field in StackOne Hub.

​
Create the API token

An Orca API token carries the role you give it, so the connection can read only what that role can read.

1

Sign in to Orca

Sign in to your Orca account, or the regional address you found above, as a user who can create API tokens.

  • Navigate to Settings > Users & Permissions > API.
  • Open API Tokens, then select Add API Token.
2

Fill in the token details

In the Add API Token dialog, fill in these fields.

  • Name: StackOne Integration
  • Description: optional, for example the reason the token exists
  • Tick Never Expire for a token that does not expire. To set an end date, clear Never Expire and pick the date in Expiration. When the token expires, the connection stops working until you paste a new token into StackOne Hub.
  • Tick Service Token, so the token is not tied to one user and keeps working if that user leaves.
3

Choose the role and scope

Choose a Role that can only read.

  • Choose Internal Viewer, a read-only role that can list the people in your organization.
  • To use a custom role instead, give it read access to users and role assignments, which the connection test checks, and to invitations, roles and groups, which the actions that list them need.
  • The connection test reads the user list and the role assignments. It is refused with a message when the role cannot read the role assignments, so pick a role that can.
  • Leave Scope access to specific resources unticked, so the token covers the whole organization. A token scoped to chosen accounts or business units sees only those, and the user list may come back short.
4

Add the token and copy it

Select Add, copy the token shown, then select Continue and store the token securely for use later.

  • The token is shown once. Orca does not show it again.
  • Paste it into the API Token field in StackOne Hub.

​
Revoke the token

To stop the connection, delete the StackOne Integration token from the API Tokens list under Settings > Users & Permissions > API in Orca. The connection stops working until you paste a new token into StackOne Hub.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Region
  • API Token
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.