Overview

Torii integrates with Veeva Vault and syncs:

• Users: name, email, username, status (active or not active), role, and groups
• Licenses: every license type in your Vault, named as it is in Vault, for example Full User, Read-only User, External User, and View-Based User

• Torii doesn't sync last login for Veeva Vault users.
• Integration Capabilities

Requirements

Accounts & Permissions

To connect this integration, we require the following:

• A Vault user whose API access token you will use. This user needs the API Access permission in their security profile or permission set. An API access token doesn't give the user access to the Vault UI.
• That user must be able to view the users in your Vault.
• That user must stay active in Vault. If the user is deactivated or deleted, the token stops working and the sync fails.
• A Vault admin to give the user these permissions, if you don't have them.

Required keys

• Vault DNS - the address of your Vault, without https://, for example acme.veevavault.com
• API Access Token - generated in Vault in the steps below

How to Generate the Required Values

Step 1: Find your Vault DNS

1. Sign in to your Vault.
2. Look at the address in your browser. Copy only the host name, for example acme.veevavault.com. Don't include https:// or anything after .com.

Step 2: Generate an API access token

1. Sign in to Vault as the user that will own the token.
2. Open your user profile: select User Profile in your user drop-down menu. If you don't see User Profile, ask a Vault admin to grant you the View User Profile permission.
3. In the API Access Tokens section, click Create.
4. Enter a Name for the token, for example Torii.
5. (Optional) In the Set to expire in dropdown, choose when the token expires. The default is 30 days. You can also choose 60 days, 90 days, or a specific date. Never Expires is available only if your Vault's security policy allows it.
6. Click Create.
7. In the "API Access Token created" dialog, click the copy icon to copy the token. The token starts with veeva-vault-.

Important: You can't see the token again after you close the dialog. Copy it before you close it. If you lose it, create a new token.

Token expiry: When the token expires, Torii can no longer sync Veeva Vault. Before the expiry date, create a new token and reconnect the integration in Torii. Tokens are tied to their owner, so deactivating or deleting the owner also stops the sync.

How to Connect the Integration

1. Go to the Integrations page in Torii.
2. Search for Veeva Vault and click Connect.
3. Enter your Vault DNS and API Access Token.
4. Click Connect.

Q&A

Q: Why might the Role column show an ID instead of a name?

A: Torii syncs each user's security profile as the role. Vault may send the profile as an ID, for example 0SP000000000106, instead of its name. When it does, Torii shows that ID.

Q: What happens when the API access token expires?

A: The sync fails and Torii shows an error that the token was rejected. Generate a new token in Vault, then reconnect Veeva Vault in Torii with the new token.

For any further questions, please contact Torii Support.