Connect Mimecast to Conduit

This walkthrough connects Mimecast (email security, in Conduit’s security category) to Conduit. Mimecast’s API 2.0 uses OAuth client credentials — a Client ID and Client Secret — plus a required Region that selects the regional Mimecast API host your account is served from.

Menu labels can change

The Mimecast steps below reflect the API 2.0 application-credential flow at time of writing; menu labels can shift between releases. If a label differs, see Mimecast’s guide to creating API 2.0 credentials.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Mimecast administrator login able to create API 2.0 application credentials (see Mimecast’s API 2.0 documentation).
• To know which region your Mimecast account is hosted in. Conduit offers: us, eu, de, ca, za, au, offshore, and je — each maps to the corresponding regional Mimecast API host.

Step 1 — Create API 2.0 credentials in Mimecast

1. Sign in to your Mimecast administration console.
2. Create an API 2.0 application and generate its credentials following Mimecast’s guide. Expected: a Client ID and a Client Secret.
3. Copy both values. The secret is shown at creation — if you lose it, generate a new one.

Caution

Copy the Client ID and Client Secret now and store them somewhere safe. Don’t paste them into chat, email, or a shared document — the next step moves them directly into Conduit, which encrypts them at rest. If you accidentally expose the pair, regenerate the secret in Mimecast first; the exposed secret becomes useless immediately.

Step 2 — Connect Mimecast in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Mimecast in the catalog (under Security) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Client ID (required) — the API 2.0 Client ID from Step 1 (the form hints: “Mimecast API 2.0 Client ID”).
   • Client Secret (required) — from Step 1.
   • Region (required) — a dropdown with us, eu, de, ca, za, au, offshore, and je. Pick the region your Mimecast account is hosted in — the credentials only work against their own region’s API host.
4. Click Connect. Expected: Conduit validates immediately by minting an OAuth token at the selected region’s Mimecast token endpoint, then shows a green Connected status. Bad credentials — or the wrong region — are rejected here, not on the first tool call. Day to day, Conduit’s Mimecast server handles the token exchange and caching for you at request time.

The credential is stored at the organization scope, so every technician in your org shares this Mimecast connection. (For per-technician credentials, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Mimecast tool. You should get real data back, and the call appears in your audit log with the correct user, vendor (mimecast), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Mimecast credentials for the selected region.”	The Client ID / Secret pair is wrong or revoked — or valid but checked against the wrong region. Confirm which region hosts your Mimecast account and reconnect.
Connect fails with “Unknown Mimecast region: …”	The region value isn’t one of the supported options. Pick a region from the dropdown rather than typing a value.
Connect fails with “Mimecast OAuth token endpoint returned HTTP …”	The regional token endpoint answered with an unexpected status — often a transient Mimecast-side issue. Wait a moment and retry.
Tool calls return 403 “no credentials for vendor”	Mimecast isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Need to rotate the secret	Generate a new secret for the API 2.0 application in Mimecast, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.