Skip to main content
An Organization Administrator registers external applications in UiPath. The application needs the seven Platform Management application scopes below, because UiPath requires all the platform-level scopes for the role export. With fewer, the default token request is refused and the connection fails. Six of the scopes only read. PM.AuthSetting also lets the application change your SAML signing certificates.

​
Find your Cloud Type

The Cloud Type is the UiPath cloud your organization signs in to.

  • Look at the address in your browser when you are signed in to UiPath.
  • cloud.uipath.com is Automation Cloud
  • govcloud.uipath.us is Automation Cloud Public Sector
  • {name}.dedicated.uipath.com is Automation Cloud Dedicated
  • Leaving Cloud Type empty uses Automation Cloud.
  • Select the matching option in the Cloud Type field in StackOne Hub.

​
Find your Dedicated Cloud Name

The Dedicated Cloud Name is the first part of your Automation Cloud Dedicated address. Skip it for the other clouds.

  • Format: {name} from {name}.dedicated.uipath.com
  • Example: acme
  • Use letters, digits and hyphens only.
  • Paste it into the Dedicated Cloud Name field in StackOne Hub.

​
Find your Organization Name

The Organization Name is the last part of your UiPath address, after the host. UiPath calls it the organization URL or Account Logical Name. It is not the Organization Name on UiPath’s organization Settings page, which is a display name.

  • Sign in to UiPath and read the address in your browser.
  • Format: {host}/{organization name}
  • Example: cloud.uipath.com/acmecorp gives acmecorp
  • A tenant name or page path after it is not part of the name.
  • Paste it into the Organization Name field in StackOne Hub.

​
Find your Organization ID

The Organization ID is the ID UiPath calls the partitionGlobalId. It is a GUID.

1

Check the sign-in address

Sign in to UiPath and look at the address you land on. It holds organizationId= followed by the ID.

  • Format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  • The address can change too fast to read.
  • Paste it into the Organization ID field in StackOne Hub.
2

Open the browser developer tools instead

Open the developer tools before you sign in, switch to the Network tab and turn on recording.

  • Sign in to UiPath Automation Cloud and select your tenant.
  • After the page loads, find a request such as the Settings API request.
  • Copy the ID that follows partitionGlobalId in its Request URL.
  • Paste it into the Organization ID field in StackOne Hub.

​
Register the external application

An external application is a confidential app that signs in as itself, with no user, using the scopes you give it.

1

Sign in to UiPath

Sign in to your UiPath Automation Cloud account as an Organization Administrator.

  • On Automation Cloud Public Sector or Dedicated, sign in at govcloud.uipath.us or {name}.dedicated.uipath.com instead.
  • Select Admin, select your organization at the top of the left panel, then select External Applications.
  • Select Add Application in the top right.
2

Name the application and choose its type

Enter a name in the Application Name field and choose the Application Type.

  • Application Name: StackOne Integration
  • Application Type: Confidential application
  • Non-confidential applications cannot use application scopes, so they cannot connect.
3

Open the scope panel

Under Resources, select Add Scopes. The Edit Resource panel opens.

  • From the Resource drop-down list, select the Platform Management API. UiPath lists each API once, and every scope below belongs to it, so you add one resource only.
  • Open the Application Scope(s) tab. The User Scope(s) tab does not apply.
  • PM.User.Read and PM.Group.Read read users and groups. The connection test needs both. PM.RobotAccount.Read reads robot accounts.
  • UiPath requires all the platform-level scopes for the role export, so PM.Audit.Read, PM.Setting.Read, PM.License.Read and PM.AuthSetting are needed too. StackOne reads the export for roles, and for the user list while UiPath hides directory users.
  • PM.AuthSetting has no read-only form. It also lets the application upload, switch and delete your SAML signing certificates.
  • Leave out every scope that ends in .Write.
4

Add the scopes

Enables actions: Get Group, Get Robot Account, Get Unified Group, Get Unified User, Get User, List Groups, List Robot Accounts, List Unified Groups, List Unified Users, List Users

Tick these application scopes, then select Save.

5

Create the application and copy the secret

Leave Redirect URL empty, because it is optional with application scopes. Select Add.

  • UiPath shows the app secret in the confirmation message. You cannot view it again.
  • Copy it and store it securely for use later.
  • Paste it into the Application Secret field in StackOne Hub.
6

Copy the Application ID

Go back to Admin > Organization > External Applications and copy the Application ID shown for the new application.

  • Paste it into the Application ID field in StackOne Hub.

​
Choose the Scopes

The Scopes field lists the scopes StackOne asks UiPath for, separated by spaces.

  • Leave it empty to request the seven scopes above: PM.Audit.Read PM.AuthSetting PM.Group.Read PM.License.Read PM.RobotAccount.Read PM.Setting.Read PM.User.Read
  • Fill it only to add scopes. Then list every scope you want, including those seven.
  • Add PM.UserLoginAttempt.Read to also read user login attempts, and PM.Directory to search the directory. Add both as application scopes on the same application.
  • Every scope you list must be on the application, otherwise UiPath refuses the token and the connection fails.

​
Directory users

Directory users are accounts from a directory linked to UiPath, such as Microsoft Entra ID. They appear in the user list only when UiPath has turned on directory users in the user list API for your organization.

  • To turn it on, ask UiPath support to enable EnableDirectoryUsersInUserListApi.
  • Until then, the user list fails with a message that says so if your groups or role assignments show directory users.
  • Directory users who are in no group and hold no role are left out, with no error.

​
Expiry, rotation and revoking

The access token lasts one hour, and StackOne requests a new one when it expires. UiPath documents no expiry for the app secret.

  • If you lose the secret, open Admin > Organization > External Applications, select the Editing icon and under App Secret select Generate New.
  • Copy the new secret, then paste it into the Application Secret field in StackOne Hub. The connection stops working until you do.
  • To revoke access, select the Editing icon and, under App Secret, select the delete icon next to each secret ID. StackOne can no longer get a token and the connection fails.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Cloud Type (Optional)
  • Dedicated Cloud Name (Optional)
  • Organization Name
  • Organization ID
  • Application ID
  • Application Secret
  • Scopes (Optional)
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.