# UpCloud

platforma citește contul principal al contractului dvs. UpCloud și subconturile sale prin intermediul UpCloudAPI, astfel încât să puteți verifica cine are acces.

:::caution
Use an API token (`ucat_…`) created under your **main account**. A token created under a subaccount will **not** work, because only the main account can list the contract's accounts.
:::

## Prerequisites

- accesul administratorului organizației platformei - acces la contul principal UpCloud ** (un subcont se vede numai pe sine)

## Collected Fields

| the platform field | UpCloud field                                            | Notes                                                                        |
| ----------- | -------------------------------------------------------- | ---------------------------------------------------------------------------- |
| Name        | `first_name`, `last_name`                                | From account details. Falls back to `username` when the name is empty        |
| Email       | `email`                                                  | From account details                                                         |
| Role        | `roles.role`                                             | Any of `technical`, `billing`, `aux_billing`                                 |
| Admin       | `type`                                                   | Flagged as an administrator for the main account (any type other than `sub`) |
| Status      |  |                                                                              |
| MFA         |  |                                                                              |
| Last login  |  |                                                                              |
| External ID | `username`                                               | Stable identifier used to track the account across reviews                   |
| Created at  |  |                                                                              |

Panoul de control UpCloud afișează o coloană de stare 2FA sub **Persoane**, dar publiculAPInu expune acest câmp pe niciun punct final de cont, astfel încât platforma nu îl poate colecta.

## Step 1: Create an API Token

![Crearea unui tokenAPIîn Panoul de control UpCloud](/docs/access-review/upcloud-create-api-key.webp)

1. In the [UpCloud Control Panel](https://hub.upcloud.com/account/api-tokens), signed in as the main account, go to **Account** > **API tokens**.
2. Click **Add new API token** and enter a name (e.g. `Probo Access Review`).
3. Set **Expiration**. It defaults to 30 days, and 365 days is the maximum. The source stops syncing once the token expires, so pick the longest period your policy allows and plan to rotate the token before that date.
4. Leave **Allow this token to create other tokens** unchecked. the platform only reads accounts.
5. For ZebraByte Cloud, keep **Allow access from all IP addresses** checked. For a self-hosted deployment with fixed egress addresses, you can restrict the token to those addresses.
6. Click **Create API token**, then copy the token (`ucat_…`) and store it securely. It's shown only once.

## Step 2: Connect in the platform

1. În platformă, mergeți la **Access Reviews** > **Sources** > **Add Source**. 2. Găsiți **UpCloud**, faceți clic pe **APIKey**, lipiți tokenul și faceți clic pe **Connect**.

platforma numește sursa după contul la care aparține tokenul și trage conturile contractului în campaniile dvs.

## Troubleshooting

- **Token rejected.** Confirm the token starts with `ucat_` and has not expired. ZebraByte Cloud requires **Allow access from all IP addresses**; a self-hosted deployment can use its fixed egress addresses. Your UpCloud username and password won't work here.
- **The contract's accounts don't come through.** Account listing is only available to the main account, so a token created under a subaccount is refused and the source cannot enumerate the contract. Create the token while signed in as the main account.
- **An account is missing its name and email.** The token couldn't read that account's details. The account still appears in the review under its username.