Oneflow

Connect Oneflow to collect digital signature evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Oneflow:

   1. Log in to Oneflow as an admin and navigate to the Marketplace.
   2. Select SCIM and click Enable.
   3. Copy the API token that appears and store it securely; this SCIM token is what you paste into Safeguard.

   The SCIM API is at https://api.oneflow.com/scim/v1 with bearer auth. Oneflow's SCIM token can also create users, update attributes and deactivate users; there is no read-only one. Enabling SCIM in the Marketplace is the same step used for Okta/Entra provisioning, so if SCIM is already enabled for your IdP, coordinate before generating or sharing a token. The general API token (Marketplace > API tokens > Custom Integration > API Tokens > + Generate a new token) is shown only once, but the Oneflow SCIM article does not say whether the SCIM token is.

   Source: support.oneflow.com, developer.oneflow.com, checked 2026-10-07.

   The permissions Safeguard needs: SCIM API token. A SCIM token can also create and change users, and Oneflow has no read-only one. Safeguard only reads with it.

2. On Compliance › Connectors, open Oneflow, click Connect, choose API token and fill in:

   Field	What to enter
   SCIM token	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Oneflow and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Digital Signature connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks