Connect Blackpoint Cyber to Conduit

This walkthrough connects Blackpoint Cyber (MDR via the CompassOne platform) to Conduit. You create an API token in CompassOne, then add it as an organization connection in Conduit. An optional Base URL field lets you override the API host, but most orgs never touch it.

Menu labels can change

The Blackpoint steps below reflect the CompassOne flow at time of writing; menu labels can shift between releases. If a label differs, see this Blackpoint Cyber CompassOne API guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Blackpoint Cyber CompassOne login with access to the platform’s API settings.

Step 1 — Create an API token in CompassOne

1. Sign in to CompassOne. Expected: the CompassOne dashboard.
2. Generate an API token following this CompassOne API guide. Expected: a token value you can copy.
3. Copy the token.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, regenerate it in CompassOne first; the exposed token becomes useless immediately.

Step 2 — Connect Blackpoint Cyber in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Blackpoint Cyber in the catalog (under Security) and click Connect. Expected: a credential form with two fields.
3. Fill the fields:
   • API Token (required) — paste the token from Step 1.
   • Base URL (optional) — leave this blank unless Blackpoint has directed you to a different API host. When blank, Conduit uses the standard CompassOne API at https://api.compassone.blackpointcyber.com/v1. If you do set it, enter the full https:// URL exactly as provided by Blackpoint — it must be reachable from the internet, and addresses pointing at localhost, private IP ranges, or cloud metadata endpoints are rejected before any request is made.
4. Click Connect. Expected: Conduit validates the token against the CompassOne API immediately and shows a green Connected status. A bad token is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Blackpoint connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Blackpoint tool, such as listing accounts. You should get real data back, and the call appears in your audit log with the correct user, vendor (blackpoint), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Blackpoint Cyber API token.”	The token is wrong, revoked, or was copied incompletely. Generate a fresh token in CompassOne and re-connect.
Connect fails with “Blackpoint returned HTTP <status>.”	The API answered with a non-auth error — usually a transient vendor-side issue, or a custom Base URL that points at the wrong place. Clear the Base URL (to use the default) and retry.
Connect fails with “Blackpoint validation failed: <details>”	Conduit couldn’t complete the request at all — typically an unreachable custom Base URL or a network error. Check the URL is a full, publicly reachable https:// address, or leave it blank.
Tool calls return 403 “no credentials for vendor”	Blackpoint isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a token.
Need to rotate the token	Generate a new API token in CompassOne, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.