---
title: "OneLogin collector"
canonical: "https://docs.devo.com/space/latest/94656971/OneLogin%20collector"
format: markdown
---
> Macro (toc)
## Service description
[OneLogin ](https://www.onelogin.com/)is a cloud-based identity and access management provider that designs, develops, and sells a unified access management platform to enterprise-level businesses and organizations.
## Data source description
The collector process the OneLogin API responses and send them to the Devo platform, which will categorize all the information received on tables in your Devo domain.
The **OneLogin Resource API** allows users to retrieve account activities for the event resource:
| **Resource type** | **Definition** | **Devo data table** |
| --- | --- | --- |
| Events | Use this API to return all the events | `auth.onelogin.events` |
Additional resources, and the corresponding Devo [table](https://devodocs.atlassian.net/wiki/spaces/latest/pages/313360445), can be configured by the collector.
## Vendor setup
### Getting OneLogin credentials
To call any of the OneLogin resource APIs, you must provide an OAuth 2.0 bearer access token in the `Authorization` header.
To get an OAuth 2.0 bearer access token, you must call the Generate Tokens API using an API credential pair (client ID and client secret).
### Creating an API credential pair
1. Access OneLogin as an account owner or administrator.
2. Go to **Developers → API Credentials**.
3. On the API Access page, click **New Credential**. Give your credential pair a meaningful name. This name will be very important if you ever need to re-access or delete the credentials. In this example, we’ve named the credentials using the name of the developer and app that will be using the credentials.
4. Select a scope for the credentials. In this case, we will select **Read all**, which gives the credential pair the ability to generate an access token that can perform GET calls for all available API resources.
5. Click **Save**. Copy your client secret and client ID to use when making the [Generate Access Token](https://developers.onelogin.com/api-docs/1/oauth20-tokens/generate-tokens) API call that will provide the access token you need to make calls to API resources. Keep these credentials secure and take care to not inadvertently embed them in shared code.
6. Click **Done**. The API Access page updates to reflect the creation of the API credential pair.
### Viewing an API credential pair
1. Access OneLogin as an account owner or administrator.
2. Go to **Settings → API**.
3. On the API Access page, click the row that corresponds to your credential pair. The credentials display.
### Generate tokens
Generate an access token and refresh token that you can use to call the resource APIs.
This API endpoint returns a response that includes status, which is not standard for OAuth 2.0 and does not work with out-of-the-box OAuth 2.0 clients. It is recommended to use the Generate Tokens v2 API for new development.
For an overview of the authorization flow, see [Authorizing Resource API Calls](https://developers.onelogin.com/api-docs/1/getting-started/authorizing-resource-api-calls).
> ⚠️ Note that once generated, an access token is valid for 10 hours.
## Run the collector
Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).
> Macro (rw-ui-tabs-macro)
>
> > Macro (rw-tab)
>
> We use a piece of software called Collector Server to host and manage all our available collectors.
>
> To enable the collector for a customer:
>
> 1. In the **Collector Server** **GUI**, access the **domain** in which you want this instance to be created
> 2. Click **Add Collector** and find the one you wish to add.
> 3. In the **Version** field, select the latest value.
> 4. In the **Collector Name** field, set the value you prefer (this name must be unique inside the same Collector Server domain).
> 5. In the sending method select **Direct Send. Direct Send** configuration is optional for collectors that create `Table` events, but mandatory for those that create `Lookups`.
> 6. In the **Parameters** section, establish the **Collector Parameters** as follows below:
>
> > ℹ️ Please, replace the placeholders ``, ``, ``and `` with the proper values obtained in previous sections of this document, except the `` value** **that can have the value you choose and `` that value are `us` and `eu` only.
>
> ### Editing the JSON configuration
>
> ```
> {
> "onelogin": {
> "id": "",
> "enabled": true,
> "requests_per_second": 5,
> "autoconfig": {
> "enabled": true,
> "refresh_interval_in_seconds": 600
> },
> "credentials": {
> "client_id": "",
> "client_secret": "",
> "region_domain": ""
> },
> "services": {
> "events": {
> "request_period_in_seconds": 60,
> "start_time": ""
> }
> }
> }
> }
> ```
>
> > ℹ️ The value chosen for the `id` field will be used internally for having independent persistence areas
>
> 
>
> > Macro (rw-tab)
>
> ### Structure
>
> The following directory structure should be created for being used when running the OneLogin collector:
>
> ```
>
> └── devo-collectors/
> └── onelogin/
> ├── certs/
> │ ├── chain.crt
> │ ├── .key
> │ └── .crt
> └── config/
> └── config-onelogin.yaml
> ```
>
> ### Devo credentials
>
> In Devo, go to **Administration → Credentials → X.509 Certificates**, download the **Certificate**, **Private key** and **Chain CA** and save them in `/devo-collectors/onelogin/certs`. Learn more about security credentials in Devo [here](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763701).
>
> 
>
> ### Editing the config-onelogin.yaml file
>
> In the **config-onelogin.yaml** file, replace the ``, `.crt`, `.key`, ``, `` and `` values and enter the ones that you got in the previous steps. In the `` placeholder, enter the value that you choose.
>
> config-onelogin.yaml
>
> ```
> globals:
> debug: false # Setup as True or False for debugging mode
> id: not_used
> name: onelogin
> persistence: # Persistence setup filesystem
> type: filesystem
> config:
> directory_name: state # Persistence directory
> outputs:
> devo_1:
> type: devo_platform
> config:
> address: collector-eu.devo.io # Devo platform address EU (for US use: collector-us.devo.io)
> port: 443
> type: SSL
> chain: chain.crt
> cert: .crt
> key: .key
> inputs:
> onelogin:
> id: # The value of this field will be used internally for having independent persistence areas
> enabled: true
> requests_per_second: 5 # Setting up requests per second. 5 recommended.
> autoconfig:
> enabled: true
> refresh_interval_in_seconds: 600 # Time wait in second between execution of autoconfig - 600s recommended.
> credentials:
> client_id: # OneLogin client ID
> client_secret: # OneLogin client Secret
> region_domain: # OneLogin Region Domain (That will be display at your URL onelogin account)i.e. "US" or "EU"
> services:
> events:
> request_period_in_seconds: 60 # Setting up request period in seconds.
> start_time: "" # (UTC) ISO8601 format: YYYY-MM-DDThh:mm:ss.mscZ. For example: 2016-01-21T09:20:15.990Z.
>
> ```
>
> ### Download the Docker image
>
> The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:
>
> | **Collector Docker image** | **SHA-256 hash** |
> | --- | --- |
> | [collector-onelogin-docker-image-1.3.0.tgz](https://drive.google.com/file/d/1J-6zPKrJZXAnBh1KFmFcgiEKsXl2XXFx/view?usp=drive_link) | `fd8298a589367a1353fd247cd95bb5a189449e9089227c6e16fd19f204849d7c` |
>
> Use the following command to add the Docker image to the system:
>
> ```
> gunzip -c collector-onelogin-docker-image-.tgz | docker load
> ```
>
> > ℹ️ Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace "``" with a proper value.
>
> The Docker image can be deployed on the following services:
>
> #### Docker
>
> Execute the following command on the root directory `/devo-collectors/onelogin/`
>
> ```
> docker run \
> --name collector-onelogin \
> --volume $PWD/certs:/devo-collector/certs \
> --volume $PWD/config:/devo-collector/config \
> --volume $PWD/state:/devo-collector/state \
> --env CONFIG_FILE=config-onelogin.yaml \
> --rm -it docker.devo.internal/collector/onelogin:
> ```
>
> > ⚠️ Replace `` with a proper value.
>
> #### Docker Compose
>
> The following Docker Compose file can be used to execute the Docker container. It must be created in the `/devo-collectors/onelogin/` directory.
>
> docker-compose.yaml
>
> ```
> version: '3'
> services:
> collector-onelogin:
> build:
> context: .
> dockerfile: Dockerfile
> image: docker.devo.internal/collector/onelogin:${IMAGE_VERSION:-latest}
> container_name: onelogin-collector
> volumes:
> - ./certs:/devo-collector/certs
> - ./config:/devo-collector/config
> - ./state:/devo-collector/state
> environment:
> - CONFIG_FILE=${CONFIG_FILE:-config-onelogin.yaml}
> ```
>
> To run the container using docker-compose, execute the following command from the `/devo-collectors/onelogin/` directory:
>
> ```
> IMAGE_VERSION= docker-compose up -d
> ```
>
> > ⚠️ Replace `` with a proper value.
## Disclaimer
An access token has a rate limit of 5,000 calls per hour. If an access token surpasses this limit, API calls will return an error. After the hour has passed, the count will be reset to a full 5,000 available calls.
Call the [Get Rate Limit](https://developers.onelogin.com/api-docs/1/oauth20-tokens/get-rate-limit) API to view current rate limits for an access token. Alternatively, you can find rate limit values in the response header for a resource API call.