Connect Spanning to Conduit

This walkthrough connects Spanning (SaaS backup) to Conduit. Spanning runs a separate API for each product it backs up, so Conduit needs three values: the Platform you’re backing up, the Admin Email of the Spanning administrator, and that admin’s API Token. The email and token authenticate together as a pair — a valid token under the wrong email fails.

Menu labels can change

The Spanning steps below reflect Spanning’s API-token flow at time of writing; menu labels can shift between releases. If a label differs, see Spanning’s application settings guide — Spanning is a Kaseya product now, and its documentation moved to Kaseya’s help site.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Spanning administrator login for the product you want to connect.
• To know which platform you’re connecting — Spanning Backup for Microsoft 365, Google Workspace, or Salesforce. Each platform has its own API and its own tokens; a token for one platform doesn’t work on another.

Step 1 — Generate an API token in Spanning

1. Sign in to the Spanning admin portal for your platform as an administrator.
2. Go to Settings > Backup & Security and, under Security settings, click Generate API Token (see Spanning’s application settings guide). Expected: a token value tied to your admin account — copy it now.
3. Copy the token, and note the email address of the admin account you generated it under — you’ll enter both in Conduit.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, revoke or regenerate it in Spanning first; the exposed token becomes useless immediately.

Step 2 — Connect Spanning in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Spanning in the catalog (under BCDR) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Platform (required) — pick the product this token belongs to: m365 (Microsoft 365), gws (Google Workspace), or salesforce. This selects which Spanning API Conduit talks to, so it must match where the token was generated.
   • Admin Email (required) — the email of the Spanning admin account the token was generated under.
   • API Token (required) — from Step 1.
4. Click Connect. Expected: Conduit validates the email/token pair against the selected platform’s API immediately and shows a green Connected status. A bad pair — or the right pair on the wrong platform — is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Spanning connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Backing up more than one platform with Spanning? Each platform is a separate API with separate tokens, and a connection holds one platform — connect the platform your org uses most through Conduit.

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Spanning tool, such as checking license or backup status. You should get real data back, and the call appears in your audit log with the correct user, vendor (spanning), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Spanning rejected the credentials (HTTP 401). The admin email and API token are pair-bound — verify both fields together. You selected platform ‘…’.”	The email/token combination is wrong — the token was generated under a different admin account, was regenerated since you copied it, or the platform doesn’t match where it was created. Check all three fields together.
Connect fails with “Spanning token lacks scope on platform ‘…’.”	The pair authenticated but Spanning returned 403 for that platform — usually a token from a different Spanning product. Generate the token in the admin portal for the platform you selected.
Connect fails with “Invalid platform ‘…’. Pick m365, gws, or salesforce.”	The platform value isn’t one of the three supported options. Re-select it from the dropdown.
Connect fails with “Spanning returned HTTP NNN: …”	Spanning’s API responded with an unexpected status — often a transient outage or maintenance. Retry after a few minutes.
Tool calls return 403 “no credentials for vendor”	Spanning isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a token.
Need to rotate the token	Regenerate the token in Spanning (this is done per admin account), then update the credential at /org/catalog — keep the Admin Email in sync if you switched accounts.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.