Agiloft for License Logic Setup Guide

Overview

The Agiloft integration connects your Agiloft contract-management knowledgebase to License Logic, so the agreements you already keep in Agiloft become the basis of your software spend, renewal and licence-utilisation picture — without anyone re-uploading a PDF by hand.

Once connected, License Logic reads your contract records each night, selects the agreements that represent technology spend, and imports the signed document for each one. Every imported contract lands in a review queue first, so nothing appears in your contract records until someone on your side has approved it.

The connection is read-only. License Logic never creates, edits or deletes anything in Agiloft.

Key Benefits

• No manual contract loading — agreements already filed in Agiloft flow into License Logic automatically, instead of being exported and re-uploaded one at a time
• Technology spend isolated automatically — only agreements that represent software, IT, cloud, telecom, data or security spend are imported; facilities, clinical, professional-services and machinery agreements are left behind
• Renewal visibility — imported contracts are parsed for term, renewal and value, feeding the renewal calendar and reminders
• Spend and licence reconciliation — contract value is matched against actual application usage from your SSO, desktop-agent and card-spend data
• Nothing lands unreviewed — every imported contract waits in the Imports review queue for a human decision before it becomes a contract record

Prerequisites

You need a License Logic account and an Agiloft administrator. The Agiloft-side work takes about 30 minutes and is done once.

License Logic Requirements

• Account: active License Logic subscription
• Role: a role holding Settings: Edit — that is what the Connect action checks
• Page: Integrations in the left sidebar, which requires Integrations: View
• To review imports afterwards: Imports: View, plus Contracts: View. Administrators hold both by default; other roles are granted them in People → Roles

Agiloft Requirements

• Edition: API services are available with the Platform edition. On older editions they require Advanced or Premium
• Role: an Agiloft administrator who can reach Setup → Access, Setup → Security and Setup → Integration
• A dedicated service account with an Admin or Standard licence (created during setup, below)
• Network: nothing to install and no firewall change. License Logic calls your Agiloft server outbound over HTTPS

Confirm your edition first. If your knowledgebase is below the edition that includes API services, the API is unavailable and none of the remaining steps will work. This is worth five minutes with your Agiloft account team before anyone starts.

Setup Guide

There is one connection method: OAuth 2.0 client credentials, which Agiloft documents as the recommended protocol for new integrations. It is a pure machine-to-machine exchange — no redirect, no consent screen, and no user password. You create a service account and an API application in Agiloft, then paste four values into License Logic.

Steps 1 to 5 are done in Agiloft by your administrator. Step 6 is done in License Logic and takes about a minute.

Step 1: Give a group read-only access to your contract tables

Setup → Access → Manage Groups → create or edit a group (for example License Logic Integration) → Tables → select each contract table → Permissions.

Grant view/read only. Do not grant create, edit or delete. Field-level permissions are available in the same wizard if you want to withhold specific fields — anything you withhold there is invisible to License Logic.

Step 2: Allow that group to use REST

Setup → Security → Web Services tab → REST Groups — add the group from Step 1. Agiloft’s own description of this field is: “Select the groups whose users are allowed to use REST.”

This is the step most often missed. It is a separate global setting from the group’s table permissions, and it lives under Security rather than Groups. If it is skipped, everything else can be configured perfectly and the connection will still fail with a permissions error.

Step 3: Create the service account

This must not be a person’s login. Per Agiloft, “all REST API calls made through the client run with the identity and permissions of the account, regardless of who initiates the request.” Binding the application to a named individual gives the integration that person’s permissions — which breaks the read-only guarantee — and the sync stops working if their account is later disabled, deprovisioned or moved between groups.

Create a dedicated user account for the integration. Four requirements:

Requirement	Detail
Native account	Must be a native Agiloft account. LDAP accounts are not compatible.
Licence	Requires an Admin or Standard licence.
Group	Add the read-only group from Step 1 to this user’s record.
Dedicated	Do not reuse this account for any other OAuth client. Agiloft invalidates a client’s tokens when another client acquires a token on the same account.

Step 4: Deploy the OAuth2 client

Setup → Integration → OAuth2 Client Setup. You will see one of three buttons:

Button	What to do
Deploy	Click it. Setup takes a few minutes to complete.
Upgrade	Already deployed, but an upgrade is available. Click it.
Configure	Already deployed and current. Continue to Step 5.

Step 5: Create the API application

On the API Application screen click New. Set the Authorization Grant Type first — the rest of the form changes based on it.

Field	Value
1. Authorization Grant Type	Client Credentials — not the default
2. Full Name	The service account from Step 3. Fill this before Contact ID — selecting the account populates Contact ID automatically.
3. Associate with Contact ID	Populated by the field above. Do not hand-type it.
4. Token Expiry in Minutes	60 (the default is 15; the maximum is 60)

Selecting Client Credentials removes the Name, Display Name and Redirect URI fields — they apply only to the browser-based Authorization Code flow. Three required fields remain, and the form lists Contact ID above Full Name even though Full Name is what fills it.

Click Apply Changes, then Enable. Agiloft generates the Client ID and Client Secret.

Two things to get right first time. The grant type must be Client Credentials — the wizard defaults to Authorization Code, which requires a person to approve each session in a browser and cannot be used for a scheduled sync. And per Agiloft’s documentation, changing the Contact ID or Redirect URI after the fact “can sometimes block your application,” requiring you to recreate it.

Step 6: Connect in License Logic

1. In License Logic, click Integrations in the left sidebar
2. Find the Agiloft card and click Connect
3. Enter your Server Hostname — for example acme.agiloft.com. Hostname only: no https://, no path
4. Enter your Knowledgebase (KB) Name — shown at the top right of your KB, next to the Help icon. It is case-sensitive; type it exactly as displayed
5. Paste the Client ID and Client Secret from Step 5
6. Click Connect

License Logic encrypts both secrets, stores them, and then checks the connection. The card shows Connected on success. If the check cannot confirm the knowledgebase, your credentials are still saved and the card reports that verification is pending rather than discarding what you entered — see Troubleshooting.

The KB name is the one value the credential check cannot fully validate on its own. Agiloft’s token endpoint takes only the grant type, client ID and client secret — the KB name is not part of the token exchange — so a mis-cased KB name can produce valid credentials that address the wrong knowledgebase. License Logic makes a second call specifically to catch that, but if you see anything other than a clean success, re-check the casing first.

What Data Is Synced

The sync runs in stages, and each stage narrows what the next one touches. This matters because it is what stops your entire contract inventory being copied into a software asset-management tool.

Stage 1 — Contract metadata

License Logic reads two Agiloft tables in bulk. From the contract table it reads five fields:

Field	Used for
id	The Agiloft record identifier — the key used to avoid re-importing the same contract twice
contract_type	The agreement type, used to select which agreements are eligible
wfstate	The workflow state, used to exclude anything not live
vendor	The supplier name
company_name	Fallback supplier name where vendor is empty

From the attachment table it reads four fields — id, contract_id, attachment_type and attached_file — which are used to find the one primary document belonging to each eligible contract.

No other field is requested. The field list is explicit in the request, so custom fields, internal notes, approval history, financial fields and party records are not read even where the service account could see them.

Stage 2 — Selecting eligible agreements

Only contracts matching both of the following are considered:

• Agreement type is one of the eight your team confirms during onboarding — typically Service Agreement/Quote, Statement of Work (SOW), Amendment/Change Order, Master Services Agreement (MSA), Purchase Agreement/Quote, Purchase Order Terms and Conditions, License Agreement and Subscription
• Workflow state is Active or Signed. Approved is deliberately excluded — it means internal review is complete but the contract is not executed. Expired, Renewed and Terminated are excluded because they are not live commitments

The agreement-type list is agreed with you, not assumed. Before the first import runs, License Logic sends a one-page summary of exactly which agreement types and states will be imported, with counts from your own knowledgebase, for your sign-off. If an agreement type appears in your knowledgebase that is not on the agreed list, it is not imported and is flagged for a decision rather than being silently included or silently dropped.

Stage 3 — Technology-spend classification

Each remaining contract is individually assessed to decide whether the supplier supplied technology under that specific agreement. Contracts in these categories are kept:

• Software / SaaS
• IT hardware
• Cloud
• Telecom
• Data and analytics
• Security

Contracts classified as professional services, facilities, machinery, clinical, real estate and finance, individual contractors, or other are set aside and not imported.

The assessment is made per contract, not per supplier, because one supplier can sell you several different things: a software licence from an instrument manufacturer is software spend, while that same manufacturer’s equipment-repair quote is not. It is also what makes amendments work — an amendment carries the same agreement type whatever it amends, so only a per-contract read can tell an amendment to a licence from an amendment to a construction agreement.

What the classifier actually sees. The classification step is given three pieces of text per contract: the supplier name, the agreement type and the primary document’s file name. It does not read the contents of your contracts. Document text is only ever read after a contract has been selected for import.

Stage 4 — The document

For each contract that survives all three stages, License Logic downloads the single primary document, verifies that it really is a PDF before storing it, and places it in encrypted storage. That upload is what triggers License Logic’s contract-extraction step, which reads the document and extracts contract terms — parties, dates, value, renewal and notice terms — using Anthropic’s Claude models via AWS Bedrock.

Supporting attachments are not imported. One contract yields one document.

Viewing Your Agiloft Data

Imported contracts do not appear directly in your contract records. They land in a review queue first.

Contracts → Imports

Every contract imported from Agiloft arrives in the Imports review queue as pending. Agiloft is one of several sources that feed this queue, alongside your connected e-signature systems. For each pending row you can see the supplier, the document, and the terms extracted from it, and then:

• Approve — the contract becomes a live contract record and appears in Documents, tagged to your default company
• Reject — the contract is set aside. Rejections are reversible

Nothing from Agiloft becomes a contract record without that decision. Pending imports are excluded from your Documents list until approved.

Access to the queue is a separate permission. The Imports queue requires Imports: View. Administrators hold it by default; other roles are granted it in People → Roles. A role holding Imports: View should also hold Contracts: View, because the queue reuses the Documents table.

Documents

Once approved, an Agiloft contract behaves exactly like a contract you uploaded yourself: it is searchable, editable, can be linked to applications and suppliers, carries notes and activity, and participates in renewal reminders. Any edit you make in License Logic is yours and is never overwritten by a later sync.

Suppliers, Applications and renewals

Because approved Agiloft contracts are ordinary contract records, they flow into the rest of the product: supplier pages show the agreements behind a vendor relationship, applications can be linked to the contract that pays for them, and contract value and term feed the renewal calendar and reminder emails.

Sync Schedule & Refresh

Automatic Daily Sync

License Logic syncs Agiloft once per day at 06:00 UTC. Each run reads your current contract and attachment metadata, and imports anything newly eligible that has not been imported before.

Initial Sync

The first sync is the long one, because it works through your existing contract history. It is deliberately paced: documents are imported in batches, with a pause of roughly twelve seconds between each one. A first import of several hundred contracts therefore takes hours, not minutes, and continues across several runs if needed.

The pacing is intentional and is not an Agiloft limit. It protects License Logic’s own contract-extraction step, which runs on every imported document. Agiloft also applies its own server-side delay to API calls and its documentation notes that REST is not intended for bulk synchronisation, so License Logic bulk-reads metadata in two calls rather than making one call per contract.

What Triggers a Sync

• Daily scheduled sync — automatically at 06:00 UTC every day
• Continuation — a large run continues itself until the eligible set is exhausted
• Reconnection — reconnecting after a disconnect resumes syncing on the next scheduled run

What a Sync Will Not Do Twice

License Logic records every contract it has already considered, including the ones it decided not to import. A contract that has been imported is not imported again, and a contract that was assessed and set aside is not re-assessed on every subsequent run. If a document fails to import, it is retried on later runs a bounded number of times rather than indefinitely.

Reconnecting does not force a full re-import. Unlike some integrations, disconnecting and reconnecting Agiloft does not replay your history — the record of what has already been imported is kept, so previously imported contracts are not duplicated. If you need a genuine re-import, contact support.

Disconnecting Agiloft

Disconnecting deletes your stored Agiloft credentials. They are removed from the database outright, not disabled behind a flag, so reconnecting means entering the Client ID and Client Secret again. Keep them somewhere safe, or be prepared to generate a new pair in Agiloft.

To disconnect:

1. Go to Integrations in the left sidebar
2. Find the Agiloft card (showing “Connected”)
3. Click Disconnect
4. Confirm in the dialog

After disconnecting

• Your Agiloft Client ID and Client Secret are deleted from License Logic
• No further syncs run, and no new contracts are imported
• Contracts already imported and approved stay in License Logic. They are your contract records — along with any edits, notes, links and reminders your team has added — and are not removed
• Other integrations are unaffected

You can also stop the connection from the Agiloft side at any time, without touching License Logic: disable the API application, remove the group from REST Groups, or disable the service account. Any of those stops the sync immediately.

Security & Data Handling

Authentication

License Logic authenticates with OAuth 2.0 client credentials against your Agiloft server’s token endpoint. What that means in practice:

• License Logic holds an application secret, not a person’s password. It cannot sign in to Agiloft as a human being
• It is revocable on its own, without disabling anyone’s user account
• Access tokens are short-lived and re-requested as needed; there is no long-lived refresh token
• The integration runs with the permissions of the service account you created — so the read-only group from Step 1 is the actual boundary, enforced by Agiloft, not by a promise from us

Read-only access

License Logic issues only read requests against your knowledgebase: a bulk metadata search and a document retrieval. It does not create, modify or delete records, attachments, users or configuration in Agiloft.

Data in Transit

All communication with your Agiloft server uses HTTPS with TLS 1.2 or above. Credentials are sent in request headers or form bodies, never in a URL or query string.

Data at Rest

Control	Detail
What we hold	A Client ID and Client Secret — never a user password
Encryption at rest	AES-256-GCM with a random initialisation vector per value, applied before the value is written to storage
Contract documents	Stored in encrypted object storage; contract records are held in an encrypted PostgreSQL database on AWS RDS
In logs	Never written
Retrievable via API	Never returned — not even to your own administrators. The connection status endpoint can return the hostname and KB name, and never the secrets
Who can connect or disconnect	Only a user holding Settings: Edit in your License Logic tenant

Tenant isolation

Credentials and imported contracts are scoped to your License Logic tenant. Connect, status and disconnect are all keyed on the caller’s own tenant, so no request from another customer can reach your connection.

Data Retention

Credentials are deleted immediately on disconnect. Imported contracts are retained as your contract records for as long as your subscription is active, and are subject to your normal contract-deletion controls in License Logic.

For more about License Logic’s security practices, see our Security Policy or contact security@licenselogic.co.

Troubleshooting

Agiloft returns a distinct error for each cause. These are the four seen most often:

Message	Cause and fix
“There is no permissions to access this resource”	Step 2 was missed. Add the group to Setup → Security → Web Services → REST Groups.
“Cannot find specified knowledgebase”	The KB name is wrong or the casing differs. Copy it exactly from the top right of your KB.
“Invalid login/password combination”	The Client ID or Client Secret is wrong, or the API application was not Enabled in Step 5.
“not allowed, please check logs”	An IP restriction is blocking us. Check Setup → Security for a REST IP blacklist or IP restriction rule.

The card says credentials were saved but not verified

Your credentials are stored and the connection will be retried. This state means the confirmation call did not come back cleanly — most often a mis-cased KB name, or the REST Groups step. Re-check the KB name casing first, then Step 2. License Logic deliberately never discards credentials because a check failed, so you do not have to regenerate them in Agiloft to try again.

Connected, but no contracts have appeared

• The first sync runs at the next scheduled time (06:00 UTC), not instantly on connect
• The initial import is paced and can take hours — contracts appear progressively, not all at once
• Imported contracts appear in Contracts → Imports, not directly in Documents. If you cannot see that page, you are missing the Imports: View permission
• If your agreements are all outside the agreed agreement types or are not in Active / Signed state, nothing is eligible. That is a filter question, not a connection fault — contact support to review the list

Fewer contracts than expected

Three filters apply in sequence, and each one is deliberate: the agreed agreement types, the Active/Signed state requirement, and the technology-spend classification. A non-technology agreement of an eligible type — a construction MSA, a clinical services agreement — is correctly not imported. If you believe a genuine technology contract was set aside, contact support with the Agiloft record ID; classification decisions are recorded per contract and can be reviewed.

A contract appears in the queue with wrong or missing terms

Extraction reads the document itself, so a scanned or image-only PDF, or a summary document that does not contain the commercial terms, will produce a thin record. You can edit any field on the contract after approving it, and the correction is preserved.

Sync stopped working after an Agiloft change

• The service account was disabled, deprovisioned, or removed from the read-only group
• The API application was disabled, or its Contact ID or Redirect URI was changed after creation — per Agiloft, changing those can block the application and it may need to be recreated
• Another OAuth client acquired a token on the same service account, which invalidates the previous client’s tokens. Use a dedicated account for License Logic only
• The group was removed from REST Groups

Frequently Asked Questions

Does License Logic modify anything in our Agiloft knowledgebase?

No. The integration issues read requests only. It does not create, edit or delete records, attachments, users or configuration. The service account’s read-only group permissions enforce this on the Agiloft side as well.

Do you receive a user’s password?

No. The connection uses OAuth 2.0 client credentials, so License Logic holds an application Client ID and Client Secret issued by Agiloft. Those cannot be used to sign in to Agiloft as a person, and they can be revoked without touching any user account.

Are all of our contracts copied into License Logic?

No, and this is the point of the staged filter. Only agreements whose type and state you have agreed to, and which are then assessed as technology spend, are imported. Everything else is left in Agiloft. Metadata for the wider set is read in order to apply the filter, but only five contract fields and four attachment fields are requested at all.

Does the classification step read the contents of our contracts?

No. It is given the supplier name, the agreement type and the primary document’s file name. Document text is read only after a contract has been selected for import, as part of extracting its terms.

How often does data sync?

Once per day at 06:00 UTC. The first import works through your existing history and can take several hours because it is deliberately paced.

Can we control what gets imported?

Yes. The agreement types and workflow states are agreed with you before the first import and can be changed. You can also restrict what License Logic can see at all using Agiloft’s group and field-level permissions — anything you withhold there is invisible to us. And every imported contract still requires approval in the Imports queue before it becomes a contract record.

What happens to imported contracts if we disconnect?

They stay. Approved contracts are your records, including any edits, notes and links your team has added. Disconnecting deletes the stored credentials and stops future syncs; it does not remove contracts.

Can we revoke access from the Agiloft side?

Yes. Disable the API application, remove the group from REST Groups, or disable the service account. Any of those stops the connection immediately. You should also disconnect in License Logic so the stored credentials are deleted.

Who at our company can see the imported contracts?

Anyone with Contracts: View can see approved contracts. The Imports review queue additionally requires Imports: View. Only a user with Settings: Edit can connect or disconnect the integration.

Do we need to keep a browser open for the sync to run?

No. Syncing runs on License Logic’s servers on a schedule. Once connected, it is fully automated.

Will the sync overwrite edits we make in License Logic?

No. A contract already imported is not imported again, so edits, notes, links and reminders you add are preserved.

We use an agreement type that was not on the agreed list. What happens?

It is not imported, and it is flagged rather than silently ignored, so it can be added to the list deliberately if it belongs there. Contact support to have it reviewed.

Support

If you need help with the Agiloft integration:

• Email: support@licenselogic.co
• In-app chat: click the chat icon in the bottom-right corner of License Logic
• Security questions: security@licenselogic.co

When contacting support, please include your company name, your Agiloft server hostname and KB name, and a description of the issue. If a specific contract is involved, its Agiloft record ID is the fastest way for us to trace it.