Skip to main content
You need a console user whose role can create roles and service users (Roles.create and Service Users.create in SentinelOne’s API). You can give a service user only the scopes your own user can reach. SentinelOne gives a token the role and scope of its service user. A token cannot be extended after it expires, and the connection then fails until you paste a new token.

​
Find your console URL

The Management Console URL is the address of your SentinelOne console, the one you sign in at.

  • Copy it from the browser address bar while you are signed in to the console.
  • Format: https://{prefix}.sentinelone.net
  • Example: https://usea1-example.sentinelone.net
  • Paste it into the Management Console URL field in StackOne Hub.
  • Paste it with or without the https prefix. Anything after the host name is ignored, and the connection always uses HTTPS.

​
Choose the permissions

The service user needs a role that can view what StackOne reads. In the role editor, click each area below, then select View. Add only the areas for the data you want.

  • Console Users lists console users. The connection test needs it, and also Accounts when you fill in Account ID.
  • Roles adds the role catalog.
  • Accounts adds accounts, which are shown as organizations.
  • Service Users adds the service user list. Skip it if you do not need service users.
  • StackOne only reads from SentinelOne. No permission to change users, roles or accounts is needed.
  • SentinelOne’s API names these permissions Users.view, Roles.view, Accounts.view and Service Users.view.
  • Create a role for StackOne that holds only these. Open Settings → Users → Roles, click Actions → New Role, and enter StackOne read only as the Role Name. A broader existing role also works, but the token then sees much more than StackOne reads.

​
Create a service user

A service user is an API identity that holds a role, so the token does not depend on a person’s account.

1

Sign in to SentinelOne

Sign in to your SentinelOne Management Console at the URL from the first section.

  • Open Settings, click the Users tab, then click Service Users in the navigation menu.
2

Start a new service user

Click Actions, then Create New Service User.

  • Name: StackOne
  • The name cannot contain =, < or >, and it cannot be changed later.
  • Leave the optional Description empty or say what the token is for.
  • Pick an Expiration Date. The list includes 1 Year and 2 Years, and Custom sets your own date and time. SentinelOne shows a security warning for anything longer than 1 month. Note the date: the connection stops when the token expires.
  • The expiration date cannot be changed after you create the user.
  • Click Next.
3

Choose the scope and role

Under Access Level, choose the scope the service user covers, then pick the role you created above.

  • Choose Global to read every user in the console. Choose Account and select one or more accounts to read only the users of those accounts. Site limits the token to the site you select and below.
  • Click Create User.
  • If SentinelOne asks you to authenticate, do so and click Confirm Action.
4

Copy the API token

In the API Token dialog, click Copy API Token and store it securely for use later.

  • SentinelOne shows the token once. After you close the dialog it cannot be shown again, and a lost token needs a new one.
  • Paste it into the API Token field in StackOne Hub.

​
Find your Account ID (optional)

The Account ID narrows the user list to one SentinelOne account. It is a filter, not an access limit. The token still reaches every account in the service user’s scope, so use the scope to limit access. Leave Account ID empty to list users from every account that scope covers.

  • Open Settings → Account, select your account, then open the Account Info tab.
  • Copy the account’s ID.
  • Format: digits only
  • Example: 1234567890123456789
  • Paste it into the optional Account ID field in StackOne Hub. A Site ID does not work here.

​
Replace or revoke the token

To rotate before the token expires, open Settings → Users → Service Users, select the service user, click Actions → Copy User, and create the copy with the same scope and role. Paste the new token into the API Token field in StackOne Hub.

  • Once the connection works with the new token, delete the old service user so its token stops working.
  • Revoking or deleting a service user invalidates its token and stops any connection that uses it.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Management Console URL
  • API Token
  • Account ID (Optional)
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.