Connect Avanan (Legacy SmartAPI) to Conduit

This walkthrough connects the legacy Avanan SmartAPI to Conduit. This is the API on smart-api-production-*.avanan.net: MSP tenant management (child MSPs, MSP users, customer tenants, licenses, usage) plus per-tenant security (events, emails, allow/block lists, quarantine and restore). It is distinct from Checkpoint Avanan, which uses the Check Point Infinity Portal API; if your Avanan is managed in the Infinity Portal, use that connector instead.

Which key you need

The SmartAPI authenticates with a Client ID and Client Secret pair. Two kinds of key exist, and the difference decides which tools work:

Key	Where it comes from	What it unlocks
MSP API key	Issued by Check Point/Avanan Support on request — through your distributor if you buy Avanan through the channel. One key per region.	Everything: the MSP management tools and the security tools for every customer tenant you manage.
Customer-tenant key	Generated inside one customer tenant’s portal.	That tenant’s security tools only. Every MSP management tool answers 403 MSP endpoint, access denied.

MSP keys are not self-service. Ask Check Point/Avanan Support, or your distributor, for an MSP SmartAPI key for each region where you manage tenants. Conduit’s avanan_test_connection tool reports which kind of key you connected.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A SmartAPI Client ID and Client Secret, and the region the key was issued for (us, eu, ca, ap, euw2 for the UK, or aps1 for India). See Avanan’s SmartAPI authentication reference and the MSP SmartAPI Reference Guide for what the API exposes.

Caution

Copy the Client ID and Client Secret and store them somewhere safe. Don’t paste them into chat, email, or a shared document — the next step moves them directly into Conduit, which encrypts them at rest. If you accidentally expose the pair, have the key revoked and reissued; the exposed pair becomes useless immediately.

Connect Avanan (Legacy SmartAPI) in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Avanan (Legacy SmartAPI) in the catalog (under Email Security) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Client ID (required).
   • Client Secret (required).
   • Region (optional, defaults to us) — the region the key was issued for. A key answers only on its own region’s host.
4. Click Connect. Expected: Conduit validates the pair immediately by performing the SmartAPI’s signed token handshake against the regional host, then shows a green Connected status. A bad pair, or a key from another region, is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this connection. (For per-technician keys, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run avanan_test_connection. The result names the key’s scopes and says whether MSP access is OK or DENIED. Then try a read-only tool such as avanan_query_events for the last 24 hours, or avanan_list_tenants with an MSP key. The call appears in your audit log with the correct user, vendor (avanan-legacy), and a successful status.

With an MSP key, the security tools cover every managed customer; pass scopes (events and search) or scope (quarantine and restore) with values from avanan_list_scopes to target one customer.

Troubleshooting

Symptom	Likely cause
Connect fails with “Avanan did not recognise this Client ID in the selected region.”	The Client ID is wrong, or the key was issued for a different region. Check the ID and pick the region the key was issued for.
Connect fails with “Invalid Avanan SmartAPI Client ID / Client Secret pair.”	The secret is wrong or was copied incompletely. Have the key reissued and re-connect with both new values.
Connect fails with “Avanan SmartAPI returned HTTP …” or “… request failed: …”	Avanan’s regional host answered with an unexpected status or could not be reached. Retry; if it persists, check Check Point’s service status.
MSP tools return “403 MSP endpoint, access denied” while avanan_test_connection shows Authentication: OK	You connected a customer-tenant key. Request an MSP API key from Check Point/Avanan Support or your distributor. The security tools keep working meanwhile.
Tool calls return 403 “no credentials for vendor”	The vendor isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Need to rotate the key	Have a new key issued, then update the credential at /org/catalog. Revoke the old key once the new one is connected.

Related

• Checkpoint Avanan (Infinity Portal) — the connector for tenants managed in the Check Point Infinity Portal.
• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.