Skip to main content

Set up Hightouch

TL;DR

Configure Hightouch roles, groups, and API keys to connect with Atlan.

Connect

Configure Hightouch roles, groups, and API keys to establish secure access for the Atlan integration.

Prerequisites​

Before you begin, make sure you have:

  • Access to Hightouch as an organization admin
  • Ability to provision system accounts in your organization directory
Custom roles require the Hightouch Business tier

Hightouch gates custom roles behind its Business tier. In the role picker, the Custom… option is disabled on lower tiers with the message "Upgrade to Business Tier for custom roles."

If your workspace isn't on the Business tier, skip Create custom role and assign the built-in Workspace viewer role instead. Workspace viewer is read-only, which is all the Atlan crawler requires.

Create group​

Groups are managed at the organization level in Hightouch, and a group is what carries a role for each workspace.

  1. Log into Hightouch and navigate to Settings > Organization > Groups.

  2. Click Add group.

  3. Enter atlan_group as the group name.

  4. Optionally select the users to add now—you can also add them later from the group's Members tab.

  5. Click Add group to save.

Create custom role​

note

This section applies only to workspaces on the Hightouch Business tier. On any lower tier, skip ahead to Assign role to group and select the built-in Workspace viewer role.

Create a custom role to grant Atlan a narrower set of read-only permissions than the built-in Workspace viewer role.

  1. Navigate to Settings > Organization > Groups and select the atlan_group you created.

  2. On the Workspaces tab, open the Role dropdown for the workspace you want Atlan to crawl.

  3. Select Custom….

  4. Enter atlan_role as the role name.

  5. Select the JSON Builder option to create the role using a JSON policy.

  6. Use the following JSON policy:

    {
      "version": "2022-04-26",
      "policies": [
        {
          "effect": "allow",
          "actions": [
            "read"
          ],
          "resource": [
            "workspace",
            "source",
            "destination",
            "model",
            "sync",
            "sync_templates"
          ]
        }
      ]
    }

  7. Save the role.

Create user and assign to group​

Create a system account user and assign it to the Atlan group.

  1. Provision a system account in your organization's directory.

  2. Create a Hightouch user account for the system account using SSO or through invites, from Settings > Organization > Users.

  3. Open Settings > Organization > Groups, select atlan_group, go to the Members tab, and add the system account user.

Assign role to group​

In Hightouch, a role isn't assigned to a group globally—it's assigned per workspace, from within the group.

  1. Navigate to Settings > Organization > Groups and select atlan_group.

  2. Open the Workspaces tab. Each workspace the group can reach is listed with its own Role dropdown.

  3. For the workspace you want Atlan to crawl, set the Role dropdown to:

    • atlan_role—if you created a custom role earlier, or
    • Workspace viewer—the built-in read-only role, on any tier below Business.

  4. Save your changes.

The available built-in roles are Workspace admin, Workspace editor, Workspace draft editor, and Workspace viewer. Selecting No access removes the group's access to that workspace.

Generate API key​

Create an API key for Atlan to authenticate with Hightouch. API keys are scoped to a single workspace.

  1. Log into Hightouch as the system account user.

  2. Switch to the workspace you want Atlan to crawl, then navigate to Settings > Workspace > API keys.

  3. Click Add API key.

  4. Enter a descriptive name for the key, such as Atlan Integration.

  5. Copy the generated API key and store it securely—Hightouch displays it only once.

  6. Click Create API key to save.

Next steps​