Connect Proofpoint to Conduit

This walkthrough connects Proofpoint (email security) to Conduit. Proofpoint authenticates with a service principal + secret pair from the Threat Insight (TAP) dashboard. Most tenants need only those two values; an optional Cluster URL field covers tenants served from a different API cluster than the default.

Not the same as Proofpoint Essentials

Conduit’s catalog also has a separate Proofpoint Essentials entry (under Email Security) for Proofpoint’s MSP product — a different API, different authentication (console username/password), and a different capability surface (org/domain/user/licensing management). If you log in at *.proofpointessentials.com rather than the Threat Insight Dashboard, you want Proofpoint Essentials instead.

Menu labels can change

The Proofpoint steps below reflect current dashboard flows; labels can shift between releases. If a label differs, see Proofpoint’s API documentation or this service-principal setup guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Proofpoint administrator login for the Threat Insight (TAP) dashboard, with permission to generate API credentials.

Step 1 — Create a service principal in Proofpoint

1. Sign in to your Proofpoint Threat Insight dashboard.
2. Generate a new API credential following Proofpoint’s API documentation (a walkthrough is also in this guide). Expected: a Service Principal value and a Secret.
3. Copy both values. The secret is shown at creation — if you lose it, generate a new credential.

Caution

Copy the service principal and secret now and store them somewhere safe. Don’t paste them into chat, email, or a shared document — the next step moves them directly into Conduit, which encrypts them at rest. If you accidentally expose the pair, revoke it in Proofpoint and generate a new one; the exposed pair becomes useless immediately.

Step 2 — Connect Proofpoint in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Proofpoint in the catalog (under Email Security) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Service Principal (required) — from Step 1.
   • API Key (required) — the secret paired with the service principal.
   • Cluster URL (optional) — leave blank unless your tenant is served from a different API cluster than the default (https://tap-api.proofpoint.com, shown as the placeholder). If you do set it, enter a full public https:// URL; Conduit rejects URLs that point at private or internal addresses.
4. Click Connect. Expected: Conduit validates the credentials immediately with an authenticated read-only probe against the Proofpoint API (at your cluster URL if you set one) and shows a green Connected status. A bad pair is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Proofpoint connection. (For per-technician credentials, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Proofpoint tool. You should get real data back, and the call appears in your audit log with the correct user, vendor (proofpoint), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Proofpoint service principal or API key.”	The pair is wrong, revoked, or copied incompletely — or it’s valid but not authorized for the cluster you pointed at. Regenerate the credential in Proofpoint and re-connect.
Connect fails with “Proofpoint cluster URL rejected: …”	The Cluster URL didn’t pass Conduit’s safety checks — it must be a full public https:// URL, not a private/internal address. Leave the field blank to use the default cluster.
Connect fails with “Proofpoint returned HTTP …”	The Proofpoint API answered with an unexpected status — often a transient service issue, or a Cluster URL that points at a host that isn’t the Proofpoint API. Check the URL and retry.
Connect fails with “Proofpoint request failed: …”	Conduit couldn’t reach the Proofpoint API at all (network error, timeout, or an unreachable Cluster URL). Verify the Cluster URL (or clear it) and retry.
Tool calls return 403 “no credentials for vendor”	Proofpoint isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a credential.
Need to rotate the credential	Generate a new service principal + secret in Proofpoint, then update the credential at /org/catalog. Revoke the old one once the new one is connected.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.