> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect UiPath with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a UiPath account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using UiPath actions.

> [!WARNING]
>
> An Organization Administrator registers external applications in UiPath. The application needs the seven Platform Management application scopes below, because UiPath requires all the platform-level scopes for the role export. With fewer, the default token request is refused and the connection fails. Six of the scopes only read. `PM.AuthSetting` also lets the application change your SAML signing certificates.

Select Actions to adjust the guideSome actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Select all
Clear

ActionScope(s)

Loading actions...No actions match your search.

Dynamic Guide URL

Copy URL

Scopes Selected

<pre role="textbox" aria-readonly="true" tabIndex="0" />

Separator

Copy scopes

## Find your Cloud Type

The **Cloud Type** is the UiPath cloud your organization signs in to.

<ul>
  <li>Look at the address in your browser when you are signed in to UiPath.</li>
  <li>`cloud.uipath.com` is **Automation Cloud**</li>
  <li>`govcloud.uipath.us` is **Automation Cloud Public Sector**</li>
  <li>`{name}.dedicated.uipath.com` is **Automation Cloud Dedicated**</li>
  <li>Leaving **Cloud Type** empty uses **Automation Cloud**.</li>
  <li>Select the matching option in the **Cloud Type** field in StackOne Hub.</li>
</ul>

## Find your Dedicated Cloud Name

The **Dedicated Cloud Name** is the first part of your Automation Cloud Dedicated address. Skip it for the other clouds.

<ul>
  <li>Format: `{name}` from `{name}.dedicated.uipath.com`</li>
  <li>Example: `acme`</li>
  <li>Use letters, digits and hyphens only.</li>
  <li>Paste it into the **Dedicated Cloud Name** field in StackOne Hub.</li>
</ul>

## Find your Organization Name

The **Organization Name** is the last part of your UiPath address, after the host. UiPath calls it the organization URL or Account Logical Name. It is not the **Organization Name** on UiPath's organization **Settings** page, which is a display name.

<ul>
  <li>Sign in to UiPath and read the address in your browser.</li>
  <li>Format: `{host}/{organization name}`</li>
  <li>Example: `cloud.uipath.com/acmecorp` gives `acmecorp`</li>
  <li>A tenant name or page path after it is not part of the name.</li>
  <li>Paste it into the **Organization Name** field in StackOne Hub.</li>
</ul>

## Find your Organization ID

The **Organization ID** is the ID UiPath calls the `partitionGlobalId`. It is a GUID.

**1. Check the sign-in address**

Sign in to UiPath and look at the address you land on. It holds `organizationId=` followed by the ID.

<ul>
  <li>Format: `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`</li>
  <li>The address can change too fast to read.</li>
  <li>Paste it into the **Organization ID** field in StackOne Hub.</li>
</ul>

**2. Open the browser developer tools instead**

Open the developer tools before you sign in, switch to the **Network** tab and turn on recording.

<ul>
  <li>Sign in to UiPath Automation Cloud and select your tenant.</li>
  <li>After the page loads, find a request such as the **Settings** API request.</li>
  <li>Copy the ID that follows `partitionGlobalId` in its **Request URL**.</li>
  <li>Paste it into the **Organization ID** field in StackOne Hub.</li>
</ul>

## Register the external application

An external application is a confidential app that signs in as itself, with no user, using the scopes you give it.

**1. Sign in to UiPath**

Sign in to your [UiPath Automation Cloud account](https://cloud.uipath.com) as an Organization Administrator.

<ul>
  <li>On Automation Cloud Public Sector or Dedicated, sign in at `govcloud.uipath.us` or `{name}.dedicated.uipath.com` instead.</li>
  <li>Select **Admin**, select your organization at the top of the left panel, then select **External Applications**.</li>
  <li>Select **Add Application** in the top right.</li>
</ul>

**2. Name the application and choose its type**

Enter a name in the **Application Name** field and choose the **Application Type**.

<ul>
  <li>**Application Name**: `StackOne Integration`</li>
  <li>**Application Type**: **Confidential application**</li>
  <li>Non-confidential applications cannot use application scopes, so they cannot connect.</li>
</ul>

**3. Open the scope panel**

Under **Resources**, select **Add Scopes**. The **Edit Resource** panel opens.

<ul>
  <li>From the **Resource** drop-down list, select the Platform Management API. UiPath lists each API once, and every scope below belongs to it, so you add one resource only.</li>
  <li>Open the **Application Scope(s)** tab. The **User Scope(s)** tab does not apply.</li>
  <li>`PM.User.Read` and `PM.Group.Read` read users and groups. The connection test needs both. `PM.RobotAccount.Read` reads robot accounts.</li>
  <li>UiPath requires all the platform-level scopes for the role export, so `PM.Audit.Read`, `PM.Setting.Read`, `PM.License.Read` and `PM.AuthSetting` are needed too. StackOne reads the export for roles, and for the user list while UiPath hides directory users.</li>
  <li>`PM.AuthSetting` has no read-only form. It also lets the application upload, switch and delete your SAML signing certificates.</li>
  <li>Leave out every scope that ends in `.Write`.</li>
</ul>

**4. Add the scopes**

Enables actions: Get Group, Get Robot Account, Get Unified Group, Get Unified User, Get User, List Groups, List Robot Accounts, List Unified Groups, List Unified Users, List Users

Tick these application scopes, then select **Save**.

<ul>
  <li>
    PM.User.Read
  </li>

  <li>
    PM.Group.Read
  </li>

  <li>
    PM.RobotAccount.Read
  </li>

  <li>
    PM.Audit.Read
  </li>

  <li>
    PM.Setting.Read
  </li>

  <li>
    PM.AuthSetting
  </li>

  <li>
    PM.License.Read
  </li>
</ul>

**5. Create the application and copy the secret**

Leave **Redirect URL** empty, because it is optional with application scopes. Select **Add**.

<ul>
  <li>UiPath shows the app secret in the confirmation message. You cannot view it again.</li>
  <li>Copy it and store it securely for use later.</li>
  <li>Paste it into the **Application Secret** field in StackOne Hub.</li>
</ul>

**6. Copy the Application ID**

Go back to **Admin** > **Organization** > **External Applications** and copy the Application ID shown for the new application.

<ul>
  <li>Paste it into the **Application ID** field in StackOne Hub.</li>
</ul>

## Choose the Scopes

The **Scopes** field lists the scopes StackOne asks UiPath for, separated by spaces.

<ul>
  <li>Leave it empty to request the seven scopes above: `PM.Audit.Read PM.AuthSetting PM.Group.Read PM.License.Read PM.RobotAccount.Read PM.Setting.Read PM.User.Read`</li>
  <li>Fill it only to add scopes. Then list every scope you want, including those seven.</li>
  <li>Add `PM.UserLoginAttempt.Read` to also read user login attempts, and `PM.Directory` to search the directory. Add both as application scopes on the same application.</li>
  <li>Every scope you list must be on the application, otherwise UiPath refuses the token and the connection fails.</li>
</ul>

## Directory users

Directory users are accounts from a directory linked to UiPath, such as Microsoft Entra ID. They appear in the user list only when UiPath has turned on directory users in the user list API for your organization.

<ul>
  <li>To turn it on, ask UiPath support to enable `EnableDirectoryUsersInUserListApi`.</li>
  <li>Until then, the user list fails with a message that says so if your groups or role assignments show directory users.</li>
  <li>Directory users who are in no group and hold no role are left out, with no error.</li>
</ul>

## Expiry, rotation and revoking

The access token lasts one hour, and StackOne requests a new one when it expires. UiPath documents no expiry for the app secret.

<ul>
  <li>If you lose the secret, open **Admin** > **Organization** > **External Applications**, select the **Editing** icon and under **App Secret** select **Generate New**.</li>
  <li>Copy the new secret, then paste it into the **Application Secret** field in StackOne Hub. The connection stops working until you do.</li>
  <li>To revoke access, select the **Editing** icon and, under **App Secret**, select the delete icon next to each secret ID. StackOne can no longer get a token and the connection fails.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Cloud Type** (Optional)</li>
  <li>**Dedicated Cloud Name** (Optional)</li>
  <li>**Organization Name**</li>
  <li>**Organization ID**</li>
  <li>**Application ID**</li>
  <li>**Application Secret**</li>
  <li>**Scopes** (Optional)</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.