> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Action1

> Connect ThreatAware to Action1 to monitor endpoint management and security

## Overview

The Action1 integration enables ThreatAware to collect read-only data from your Action1 console, providing visibility into endpoint inventory, management status, and security posture across your organisation.

<Info>
  **Connection Method**: API Credentials
  **Setup Time**: 15 minutes
  **Access Required**: Action1 Account with API access
</Info>

## Data collected

The Action1 integration provides:

* Endpoint inventory and device management status
* Patch and update compliance information
* Security software status and configuration
* Software inventory and compliance metrics

## Use cases

<CardGroup cols={2}>
  <Card title="Endpoint Management" icon="computer">
    Monitor endpoint inventory and management status in Action1
  </Card>

  <Card title="Patch Management" icon="hammer-wrench">
    Track patch and update compliance across your endpoints
  </Card>

  <Card title="Security Compliance" icon="shield-check">
    Verify endpoints meet security requirements and policies
  </Card>

  <Card title="Device Inventory" icon="database">
    Maintain complete visibility into managed endpoints
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Action1 Console">
    Access the [Action1 Console](https://app.action1.com) with your account credentials.
  </Step>

  <Step title="Retrieve API Credentials">
    Locate your API connection details:

    * You will need to collect the following information from your Action1 account:
      * **API URL**: `https://app.action1.com`
      * **Client ID**
      * **Client Secret**
      * **Organisation ID** (example format: `57d69fc2-2e96-4741-a573-aeb09fd41017`)

    <Tip>
      Your Client ID, Client Secret, and Organisation ID are typically available in your Action1 account settings or API configuration section.
    </Tip>
  </Step>

  <Step title="Log in to ThreatAware">
    Open your ThreatAware account and prepare for integration setup:

    * Navigate to the Action1 integration setup page
    * You will have fields for entering the API credentials
  </Step>

  <Step title="Enter API Credentials">
    Input your Action1 connection details:

    * **API URL**: `https://app.action1.com`
    * **Client ID**: Enter your Action1 Client ID
    * **Client Secret**: Enter your Action1 Client Secret
    * **Organisation ID**: Enter your Action1 Organisation ID

    <Warning>
      Ensure you copy the credentials accurately. Incorrect credentials will cause authentication failure.
    </Warning>
  </Step>

  <Step title="Authorize Integration">
    Complete the connection:

    * Click the **Authorize** button to enable integration with ThreatAware
    * The system will attempt to connect to Action1 using the credentials you provided
  </Step>

  <Step title="Verify Connection">
    After authorization:

    * Check that the **Integration Status** shows as **Active** in ThreatAware
    * Confirm that endpoint data is appearing in ThreatAware
    * Wait for the first data synchronization cycle to complete
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API URL" icon="link">
    **Field Name**: Action1 API URL
    **Type**: String
    **Value**: `https://app.action1.com`
    **Description**: The base URL for Action1 API access

    This is the standard Action1 API endpoint and should not be modified.
  </Accordion>

  <Accordion title="Client ID" icon="key">
    **Field Name**: Action1 Client ID
    **Type**: String
    **Description**: The unique identifier for your Action1 API application

    This ID is used to identify your integration and must be kept confidential.
  </Accordion>

  <Accordion title="Client Secret" icon="lock">
    **Field Name**: Action1 Client Secret
    **Type**: Password (encrypted)
    **Description**: The secret key associated with your Action1 Client ID

    Store this credential securely in your organisation's password manager. Treat it like a password.
  </Accordion>

  <Accordion title="Organisation ID" icon="building">
    **Field Name**: Action1 Organisation ID
    **Type**: String
    **Example**: `57d69fc2-2e96-4741-a573-aeb09fd41017`
    **Description**: The unique identifier for your Action1 organisation

    This ID specifies which organisation within Action1 to connect to.
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to the Action1 integration page in ThreatAware
   * Confirm the integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait up to 60 minutes for initial data synchronization
   * Search for known endpoints in ThreatAware
   * Verify the device and management data matches your Action1 console

3. **Test Queries**
   * Create a test query to filter endpoints managed by Action1
   * Verify device inventory and compliance data is being collected correctly

## Troubleshooting

<AccordionGroup>
  <Accordion title="Credentials Verification Failed" icon="triangle-exclamation">
    **Symptoms**: Integration shows authentication or credential error

    **Solutions**:

    * Double-check all four credentials are correct:
      * API URL should be exactly: `https://app.action1.com`
      * Client ID, Client Secret, and Organisation ID must be accurate
    * Ensure there are no extra spaces or truncated values
    * Verify the credentials were copied from the correct Action1 account
    * Check if your Action1 account is still active and in good standing
    * Regenerate credentials if you suspect they have been compromised
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the Action1 console is accessible at `https://app.action1.com`
    * Check firewall rules allow outbound HTTPS (443) to Action1's servers
    * Confirm your network connectivity is stable
    * Test accessing the Action1 console directly in a browser
    * Check Action1 service status for any ongoing issues
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no endpoint data appears

    **Solutions**:

    * Verify there are endpoints enrolled in Action1 in your organisation
    * Check that the Organisation ID is correct for the organisation with endpoints
    * Confirm the Client ID and Client Secret have not been revoked
    * Wait for the next sync cycle (typically hourly)
    * Review ThreatAware integration logs for error messages
    * Contact Action1 support if you need to verify API access
  </Accordion>

  <Accordion title="Permission Issues" icon="ban">
    **Symptoms**: Integration connects but receives "Access Denied" errors

    **Solutions**:

    * Verify the Client ID and Client Secret have appropriate API permissions
    * Check that your Action1 account has permission to access the specified Organisation ID
    * Ensure the API application in Action1 has not been disabled
    * Review Action1 documentation for required API permissions
    * Contact Action1 support to verify your API credentials have correct permissions
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Action1 Console" icon="link" href="https://app.action1.com">
    Access your Action1 console
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Store your Client ID and Client Secret securely in your password manager
  * Document when credentials were created and by whom
  * Periodically review API credentials in your Action1 account
  * Rotate credentials per your organisation's security policy
  * Create a dedicated API application for ThreatAware if possible
</Tip>

<Tip>
  **Security Considerations**

  * Keep your Client Secret strictly confidential (treat it like a password)
  * Never share API credentials with unauthorized personnel
  * Monitor ThreatAware authentication logs for failed attempts
  * Review your Action1 API usage logs periodically
  * Follow your organisation's least privilege principles
</Tip>