Connect Blackpoint Cyber to Conduit

This walkthrough connects Blackpoint Cyber (MDR via the CompassOne platform) to Conduit. You create an API token in CompassOne, then add it as an organization connection in Conduit. An optional Base URL field lets you override the API host, but most orgs never touch it.

Menu labels can change

The Blackpoint steps below reflect the CompassOne flow at time of writing; menu labels can shift between releases. If a label differs, see this Blackpoint Cyber CompassOne API guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Blackpoint Cyber CompassOne login with access to the platform’s API settings.

Step 1 — Create an API token in CompassOne

1. Sign in to CompassOne. Expected: the CompassOne dashboard.
2. Generate an API token following this CompassOne API guide. Expected: a token value you can copy.
3. Copy the token.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, regenerate it in CompassOne first; the exposed token becomes useless immediately.

Step 2 — Connect Blackpoint Cyber in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Blackpoint Cyber in the catalog (under Security) and click Connect. Expected: a credential form with two fields.
3. Fill the fields:
   • API Token (required) — paste the token from Step 1.
   • Base URL (optional) — leave this blank unless Blackpoint has directed you to a different API host. When blank, Conduit uses https://api.blackpointcyber.com/v1. If you do set it, enter the full https:// URL. A trailing slash is removed, and a URL with no path (for example https://api.blackpointcyber.com) gets /v1 appended. A saved value on the retired host api.compassone.blackpointcyber.com is rewritten to api.blackpointcyber.com. The URL must be reachable from the internet, and addresses pointing at localhost, private IP ranges, or cloud metadata endpoints are rejected before any request is made.
4. Click Connect. Expected: Conduit validates the token against the Blackpoint API immediately and shows a green Connected status. A bad token is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Blackpoint connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Blackpoint tool, such as listing accounts. You should get real data back, and the call appears in your audit log with the correct user, vendor (blackpoint), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Blackpoint Cyber API token (HTTP 401).” or “(HTTP 403).”	The token is wrong, revoked, or was copied incompletely. HTTP 401 and 403 mean the key was rejected. Generate a fresh token in CompassOne and re-connect.
Connect fails with “That Base URL isn’t the Blackpoint API (HTTP 404). Clear it to use the default.”	The host answered, but that path is not the API. Clear Base URL to use https://api.blackpointcyber.com/v1. Conduit already appends /v1 when the path is missing and rewrites the retired api.compassone.blackpointcyber.com host, so a 404 after that means the host itself is not the Blackpoint API.
Connect fails with “Blackpoint returned HTTP <status>.”	The API answered with some other non-auth error — usually a transient vendor-side issue, or a custom Base URL that points at the wrong place. The message includes the HTTP status. Clear the Base URL (to use the default) and retry.
Connect fails with “Base URL rejected: Hostname did not resolve.” or “Blackpoint validation failed: <details>”	Conduit couldn’t complete the request at all — typically an unreachable custom Base URL. Check the URL is a full, publicly reachable https:// address, or leave it blank. The default host is https://api.blackpointcyber.com/v1. api.compassone.blackpointcyber.com does not resolve and is not the API.
Tool calls return 403 “no credentials for vendor”	Blackpoint isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a token.
Need to rotate the token	Generate a new API token in CompassOne, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.