Set up a Zuora connector

Capabilities

Resource	Sync	Provision
Accounts
Groups
Roles

Additional functionality: The Zuora connector supports automatic account provisioning. Notes:

The connector syncs users, security groups, and roles through the Zuora OneID SCIM 2.0 API.
Roles live on each user’s roles attribute (no standalone /Roles endpoint). The connector discovers the open-ended role catalog by paginating users during role sync (one page per List call; sync dedupes) and emits membership grants from each account.
SCIM models roles as a multi-valued attribute. Granting a role appends it to the user’s current roles[]; revoking removes only that value and leaves any other roles intact. Revoking the last remaining role is rejected.
Account creation creates SSO (federated) users by default and returns the existing user when the username already exists.

Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the Perform connector action automation step.

Action name	Additional fields	Description
`enable_user`	`user_id` (string, required)	Reactivates a Zuora OneID user by setting `active` to `true`
`disable_user`	`user_id` (string, required)	Deactivates a Zuora OneID user by setting `active` to `false`
`update_user`	`user_id` (string, required); `user_profile` (JSON string, required)	Updates profile attributes from a JSON object (used by C1 push rules / automated profile sync)
`update_profile`	`user_id` (resource, required); `displayName`, `givenName`, `familyName`, `externalId`, `custom_attributes` (optional)	Updates a user’s name, display name, federated ID, or non-reserved profile attributes

Understanding roles in Zuora

Zuora OneID stores role membership on the SCIM user resource (roles[]), not as a separate Roles collection. At sync time the connector:

Discovers role resources by paginating users and reading user.roles[] during role sync (always seeds USER on the first page; docs mention USER / ADMIN, but any additional values present on users are included — the catalog is open-ended; duplicate role resources across pages are ignored by sync).
Emits membership grants from each user (profile["roles"]) so there is no role→members scan and no shared user cache between builders.

Granting a role appends it to the user’s existing roles[].
Revoking a role removes only that value and preserves the user’s other roles.
Revoking the user’s last remaining role is rejected because Zuora requires at least one role.

Gather Zuora credentials

To configure the Zuora connector, you need administrator access in Zuora OneID to create an OAuth 2.0 client with the admin scope.

Create an OAuth 2.0 client:

Navigate to Platform > API > OAuth Clients.
Click Create OAuth Client.
Select Client Credentials as the grant type.
Grant the client the admin scope.

The admin scope is used by C1 when automatically provisioning and deprovisioning access. If you do not want C1 to perform these tasks, do not grant this scope.

Click Create.
Copy and save the Client ID and Client Secret securely. The secret is shown only once.

For more information, see Zuora authentication and the Zuora SCIM API.

Configure the Zuora connector

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Integrations > Connectors and click Add connector.

Search for Zuora and click Add.

Choose how to set up the new Zuora connector:

Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
Add the connector to a managed app (select from the list of existing managed apps)
Create a new managed app

Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.If you choose someone else, C1 notifies the new connector owner by email that their help is needed to complete the setup process.

Click Next.

Find the Settings area of the page and click Edit.

Paste the credentials into the relevant fields:

zuora-domain (required): Zuora OneID domain (e.g. https://one.zuora.com)
zuora-client-id (required): OAuth 2.0 Client ID for Zuora OneID
zuora-client-secret (required): OAuth 2.0 Client Secret for Zuora OneID

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Zuora connector is now pulling access data into C1.

Follow these instructions to use the Zuora connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

Official download center: For stable binaries (Windows/Linux/macOS) and container images.
GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Zuora connector

In C1, navigate to Integrations > Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new Zuora connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users.

Click Next.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Zuora connector deployment:

Secrets configuration

# baton-zuora-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-zuora-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Zuora credentials
  BATON_ZUORA_DOMAIN: <Zuora OneID domain, e.g. https://one.zuora.com>
  BATON_ZUORA_CLIENT_ID: <Zuora OAuth Client ID>
  BATON_ZUORA_CLIENT_SECRET: <Zuora OAuth Client Secret>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-zuora.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-zuora
  labels:
    app: baton-zuora
spec:
  selector:
    matchLabels:
      app: baton-zuora
  template:
    metadata:
      labels:
        app: baton-zuora
        baton: true
        baton-app: zuora
    spec:
      containers:
      - name: baton-zuora
        image: public.ecr.aws/conductorone/baton-zuora:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-zuora
        envFrom:
        - secretRef:
            name: baton-zuora-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Applications. On the Managed apps tab, locate and click the name of the application you added the Zuora connector to. Zuora data should be found on the Entitlements and Accounts tabs.

Done. Your Zuora connector is now pulling access data into C1.

⌘I

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Zuora connector

Capabilities

Connector actions

Understanding roles in Zuora

Gather Zuora credentials

Configure the Zuora connector

Resources

Step 1: Set up a new Zuora connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

​Capabilities

​Connector actions

​Understanding roles in Zuora

​Gather Zuora credentials

​Configure the Zuora connector

​Resources

​Step 1: Set up a new Zuora connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Connector actions

Understanding roles in Zuora

Gather Zuora credentials

Configure the Zuora connector

Resources

Step 1: Set up a new Zuora connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector