Connect Checkpoint Avanan to Conduit

This walkthrough connects Checkpoint Avanan (email security) to Conduit. Avanan authenticates with a client-credentials pair — a Client ID and an API Secret Key — issued from the Checkpoint Infinity Portal. You create the key pair there, then add it as an organization connection in Conduit. Once connected, any MCP client your organization uses can call Avanan tools through Conduit’s gateway.

Menu labels can change

The Infinity Portal steps below reflect Checkpoint’s API-key flow at time of writing; menu labels can shift between releases. If a label differs, follow Checkpoint’s Infinity Portal API keys guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Checkpoint Infinity Portal login with permission to create API keys for your Avanan (Harmony Email & Collaboration) tenant. See Checkpoint’s Harmony Email & Collaboration docs for what the API exposes.

Step 1 — Create an API key in the Infinity Portal

1. Sign in to the Checkpoint Infinity Portal.
2. Create a new API key following Checkpoint’s API keys guide. Expected: the portal issues a Client ID and a Secret Key.
3. Copy both values. The secret is shown at creation — if you lose it, create a new key.

Caution

Copy the Client ID and Secret Key now and store them somewhere safe. Don’t paste them into chat, email, or a shared document — the next step moves them directly into Conduit, which encrypts them at rest. If you accidentally expose the pair, revoke the key in the Infinity Portal and create a new one; the exposed pair becomes useless immediately.

Step 2 — Connect Checkpoint Avanan in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Checkpoint Avanan in the catalog (under Email Security) and click Connect. Expected: a credential form with two fields.
3. Fill the fields:
   • Client ID (required) — the Client ID from Step 1.
   • API Secret Key (required) — the Secret Key from Step 1.
4. Click Connect. Expected: Conduit validates the pair immediately by signing in to Avanan’s Smart API with a client-credentials exchange, then shows a green Connected status. A bad pair is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Avanan connection. (For per-technician keys, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Avanan tool. You should get real data back, and the call appears in your audit log with the correct user, vendor (avanan), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Checkpoint Avanan client credentials.”	The Client ID / Secret Key pair is wrong, was revoked, or was copied incompletely. Create a fresh API key in the Infinity Portal and re-connect with both new values.
Connect fails with “Checkpoint Avanan returned HTTP …”	Avanan’s sign-in endpoint answered with an unexpected status — often a transient service issue. Wait a moment and retry; if it persists, check Checkpoint’s service status.
Connect fails with “Checkpoint Avanan request failed: …”	Conduit couldn’t reach Avanan’s API at all (network error or timeout). Retry; if it persists, check Checkpoint’s service status.
Tool calls return 403 “no credentials for vendor”	Avanan isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Need to rotate the key	Create a new API key in the Infinity Portal, then update the credential at /org/catalog. Revoke the old key once the new one is connected.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.