> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect SentinelOne with API Token – StackOne Hub

> Link a SentinelOne account in the StackOne Hub using API Token. End-user guide to authorize the integration and start using SentinelOne actions.

> [!WARNING]
>
> You need a console user whose role can create roles and service users (`Roles.create` and `Service Users.create` in SentinelOne's API). You can give a service user only the scopes your own user can reach. SentinelOne gives a token the role and scope of its service user. A token cannot be extended after it expires, and the connection then fails until you paste a new token.

## Find your console URL

The Management Console URL is the address of your SentinelOne console, the one you sign in at.

<ul>
  <li>Copy it from the browser address bar while you are signed in to the console.</li>
  <li>Format: `https://{prefix}.sentinelone.net`</li>
  <li>Example: `https://usea1-example.sentinelone.net`</li>
  <li>Paste it into the **Management Console URL** field in StackOne Hub.</li>
  <li>Paste it with or without the `https` prefix. Anything after the host name is ignored, and the connection always uses HTTPS.</li>
</ul>

## Choose the permissions

The service user needs a role that can view what StackOne reads. In the role editor, click each area below, then select **View**. Add only the areas for the data you want.

<ul>
  <li>**Console Users** lists console users. The connection test needs it, and also **Accounts** when you fill in **Account ID**.</li>
  <li>**Roles** adds the role catalog.</li>
  <li>**Accounts** adds accounts, which are shown as organizations.</li>
  <li>**Service Users** adds the service user list. Skip it if you do not need service users.</li>
  <li>StackOne only reads from SentinelOne. No permission to change users, roles or accounts is needed.</li>
  <li>SentinelOne's API names these permissions `Users.view`, `Roles.view`, `Accounts.view` and `Service Users.view`.</li>
  <li>Create a role for StackOne that holds only these. Open **Settings** → **Users** → **Roles**, click **Actions** → **New Role**, and enter `StackOne read only` as the **Role Name**. A broader existing role also works, but the token then sees much more than StackOne reads.</li>
</ul>

## Create a service user

A service user is an API identity that holds a role, so the token does not depend on a person's account.

**1. Sign in to SentinelOne**

Sign in to your SentinelOne Management Console at the URL from the first section.

<ul>
  <li>Open **Settings**, click the **Users** tab, then click **Service Users** in the navigation menu.</li>
</ul>

**2. Start a new service user**

Click **Actions**, then **Create New Service User**.

<ul>
  <li>Name: `StackOne`</li>
  <li>The name cannot contain `=`, `<` or `>`, and it cannot be changed later.</li>
  <li>Leave the optional **Description** empty or say what the token is for.</li>
  <li>Pick an **Expiration Date**. The list includes **1 Year** and **2 Years**, and **Custom** sets your own date and time. SentinelOne shows a security warning for anything longer than 1 month. Note the date: the connection stops when the token expires.</li>
  <li>The expiration date cannot be changed after you create the user.</li>
  <li>Click **Next**.</li>
</ul>

**3. Choose the scope and role**

Under **Access Level**, choose the scope the service user covers, then pick the role you created above.

<ul>
  <li>Choose **Global** to read every user in the console. Choose **Account** and select one or more accounts to read only the users of those accounts. **Site** limits the token to the site you select and below.</li>
  <li>Click **Create User**.</li>
  <li>If SentinelOne asks you to authenticate, do so and click **Confirm Action**.</li>
</ul>

**4. Copy the API token**

In the **API Token** dialog, click **Copy API Token** and store it securely for use later.

<ul>
  <li>SentinelOne shows the token once. After you close the dialog it cannot be shown again, and a lost token needs a new one.</li>
  <li>Paste it into the **API Token** field in StackOne Hub.</li>
</ul>

## Find your Account ID (optional)

The Account ID narrows the user list to one SentinelOne account. It is a filter, not an access limit. The token still reaches every account in the service user's scope, so use the scope to limit access. Leave **Account ID** empty to list users from every account that scope covers.

<ul>
  <li>Open **Settings** → **Account**, select your account, then open the **Account Info** tab.</li>
  <li>Copy the account's ID.</li>
  <li>Format: digits only</li>
  <li>Example: `1234567890123456789`</li>
  <li>Paste it into the optional **Account ID** field in StackOne Hub. A Site ID does not work here.</li>
</ul>

## Replace or revoke the token

To rotate before the token expires, open **Settings** → **Users** → **Service Users**, select the service user, click **Actions** → **Copy User**, and create the copy with the same scope and role. Paste the new token into the **API Token** field in StackOne Hub.

<ul>
  <li>Once the connection works with the new token, delete the old service user so its token stops working.</li>
  <li>Revoking or deleting a service user invalidates its token and stops any connection that uses it.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Management Console URL**</li>
  <li>**API Token**</li>
  <li>**Account ID** (Optional)</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.