Overview
The MasterControl integration reads named-user seat consumption from MasterControl — so the named licences you have purchased can be compared with the ones actually assigned.
What the connection is for
MasterControl licenses by named user, and typically by named-user type — a quality-system order form will name distinct quantities of distinct user classes. That is the licence model License Logic is designed for: named seats, held by named people, with a purchased quantity to compare against.
Key Benefits
- Named-seat visibility — who holds a MasterControl seat, and of which type
- Reconciliation against your order form — quantities purchased against quantities assigned
- Reclaim candidates — named seats assigned to people with no matching activity
What you get
- A self-serve connection on the Integrations page
- Your API key stored encrypted against your tenant
- Connection status visible to your team
Prerequisites
You need a License Logic account and a MasterControl administrator.
License Logic Requirements
- Account: active License Logic subscription
- Role: a role holding Settings: Edit — that is what the Connect action checks
- Page: Integrations in the left sidebar, which requires Integrations: View
If the Integrations page is missing, or Connect does nothing. These are two different permissions. Integrations: View shows the page and the tiles; Settings: Edit is what allows a connection to be made. A user can hold the first without the second, see the tile, and be unable to complete the connection. Your License Logic administrator grants both in People → Roles.
MasterControl Requirements
- Account: an active MasterControl site
- API access: the MasterControl API Toolkit available on your subscription — see the note below
- Role: an administrator able to generate an API key on your site
- Your site URL — for example
yourcompany.mastercontrol.com - Network: nothing to install. License Logic calls MasterControl outbound over HTTPS
Check whether API access is included in your subscription. MasterControl offers API access as the API Toolkit, and whether it is included varies by agreement. Some customers already hold it as part of their existing subscription. Confirm with your MasterControl administrator or account team before starting — it takes one email and saves a wasted afternoon.
Setup Guide
A note on this section, so you know what you are reading. MasterControl does not publish a public API reference — its documentation lives inside the customer help portal, and the page covering API access is not publicly readable. This guide therefore documents what we can state accurately: what License Logic needs from you and how the connection works on our side. The exact menu path for generating a key inside your MasterControl site is best confirmed with your MasterControl administrator or their support team, who can see the documentation for your version. We would rather send you to the right person than invent a menu path.
Step 1: Generate an API key in MasterControl
MasterControl’s documentation states that you must generate an API key in order to use the MasterControl APIs, and that the REST API expects that key to be passed in the Authorization header of each call. Your MasterControl administrator generates the key from your site’s administration area.
If you cannot locate the option, MasterControl’s own training material covers it (their Integrations: Send API Calls course), and their support team can point your administrator to the right screen for your version.
Ask for a key dedicated to this integration. Where MasterControl allows more than one key, a key used only by License Logic can be revoked without affecting anything else you have integrated. Where it does not, be aware that revoking the key later will affect every system using it.
Step 2: Note your site URL
This is your MasterControl hostname — for example yourcompany.mastercontrol.com. Hostname only: no https:// and no path.
Step 3: Connect in License Logic
- In License Logic, click Integrations in the left sidebar
- Find the MasterControl tile and click Connect
- Enter your Site URL
- Paste the API key from Step 1
- Click Connect
| Field | Required | What to enter |
|---|---|---|
| Site URL | Yes | yourcompany.mastercontrol.com. Hostname only, no protocol or path |
| API key | Yes | The key from Step 1. Stored encrypted; never shown again |
Your credentials are stored and the tile records the connection as saved but not yet confirmed. That is the correct outcome — see Security & Data Handling.
What Data Is Synced
Users and named-seat type
MasterControl licenses by named user, and typically by named-user class — a quality-system order form will name distinct quantities of distinct user types rather than one undifferentiated seat count. That is the shape License Logic is built for, and it is what this integration reads:
- The user list — name, email address (the join key to your employee records), and account status
- The named-user type each person holds — the field your order form quantities are expressed in
- Last activity, where MasterControl exposes it — which turns a seat list into a reclaim list
One thing we confirm with you during onboarding. MasterControl does not publish a public API reference — its documentation lives inside the customer help portal, and the available endpoints vary by version. API access is provided through the API Toolkit, and the REST API takes your key in an
Authorizationheader. We confirm the exact endpoints against your own instance’s documentation as part of setting you up, which is why this section describes what is read rather than naming objects that may differ on your version. If your MasterControl administrator can share that documentation, it makes this quicker.
Where the purchased number comes from. MasterControl does not publish an endpoint reporting how many named licences you have bought — only who currently holds one. So the assigned side comes from the API and the purchased side comes from your MasterControl contract in License Logic. That combination still answers the question that matters (bought against used); it is just worth knowing which half comes from where, particularly if your contract record is out of date.
Read-only, and narrow. The integration reads user and licence information. It reads no documents, no training records, no CAPAs, no change controls and no quality records of any kind, and it writes nothing. MasterControl remains your validated system; License Logic is not part of it and does not enter its scope.
Where Your MasterControl Data Appears
MasterControl data lands in the places you already use to answer licence questions, rather than in a separate MasterControl area you would have to remember to visit.
Applications
Your MasterControl row on the Applications page shows named-seat facts rather than sign-in counts:
- Total licences — the seats you hold, sourced from the MasterControl API rather than typed in by hand
- Assigned — how many of those seats are actually allocated to a person
- Breakdown by licence type — entitled against assigned, per licence, ordered so the largest gap is first. That top row is the one worth acting on, and it is rarely the alphabetically-first one
- Idle seats — the difference, which is the number that converts into a renewal conversation
Application drill-down
Opening MasterControl shows every named-seat holder and the seat type they hold, so the quantities on your order form can be checked against the people actually holding them.
Insights → Employee
Each employee’s record gains MasterControl as a source alongside SSO sign-in, desktop agent and card-spend data. Opening a person shows the applications they hold, so a leaver review or a role change can see the MasterControl seat in the same place as everything else they hold.
Suppliers and renewals
Because seat counts arrive as data rather than as a number someone typed into a contract, your MasterControl agreement can be compared against actual allocation as the renewal approaches — which is the moment the difference is worth money.
Two switches, not one. A tenant needs the integration connected and the licence display enabled for it. That is deliberate: it stops a seat panel appearing for a tenant whose connection cannot actually compute one, which would show an empty panel rather than an honest absence. We enable both together and tell you when we have.
Sync Schedule & Refresh
Daily sync
License Logic reads MasterControl once per day, overnight UTC, in the same window as our other licence integrations. Each run replaces the previous day’s picture, so revoked seats and new assignments are both reflected without anything to reconcile by hand.
Initial sync
Your first sync is scheduled once your connection is confirmed. It reads user records only and completes quickly.
What triggers a sync
- Initial connection — your first sync is scheduled once your connection is confirmed
- Daily scheduled sync — automatically, once per day
- Reconnection — reconnecting with new credentials resumes syncing on the next scheduled run
A failed sync leaves yesterday’s data in place. If a run cannot complete — MasterControl is unreachable, or the credential has been revoked — License Logic keeps the previous successful result rather than emptying the panel. “This tenant has no licences” and “we could not read them today” look identical on screen, so we never let a failure produce the first one.
Disconnecting MasterControl
Disconnecting deletes your stored MasterControl credentials. They are removed from the database outright, not disabled behind a flag, so reconnecting means entering them again, and any data already synced is removed with them. Your MasterControl account itself is untouched, but you may need to issue a new credential there if you did not keep the original.
To disconnect:
- Go to Integrations in the left sidebar
- Find the MasterControl tile (showing “Connected”)
- Click Disconnect
- Confirm in the dialog
Revoking from the MasterControl side
Ask your MasterControl administrator to revoke or regenerate the API key. The connection stops working immediately. If the key is shared with other integrations, revoking it will stop those too — which is why a dedicated key is worth asking for at setup.
Revoking on the vendor side and disconnecting in License Logic are independent. Doing both is the complete removal: one stops the credential working, the other removes our copy of it.
Security & Data Handling
What License Logic holds
A single MasterControl API key — never a user password. License Logic cannot sign in to MasterControl as a person, and the key can be revoked without touching anyone’s account. Also your site hostname, which is not a secret.
| Control | Detail |
|---|---|
| Encryption at rest | AES-256-GCM with a random initialisation vector per value, applied before the value is written to storage |
| In logs | Never written. Connection events are logged with the credential values redacted |
| Retrievable via API | Never returned — not even to your own administrators. The connection-status endpoint is built from the non-secret fields only, so a secret cannot be read back through it |
| In transit | TLS 1.2 or above, passed in a request header or form body. Never placed in a URL or query string |
| Who can connect or disconnect | Only a user holding Settings: Edit in your License Logic tenant |
| Who can see the connection status | A user holding Integrations: View. Status shows the non-secret settings, whether the connection is verified, and when it was made |
| Tenant scope | Stored against your License Logic tenant. Connect, status and disconnect are all keyed on the caller’s own tenant, so no request from another customer can reach your connection |
| Permissions the key carries | Whatever MasterControl grants that key. License Logic cannot widen it — if you want to narrow what we could ever see, narrow the key |
Verification on connect
License Logic does not verify this credential on connect. There is no published MasterControl endpoint we have been able to read our own documentation for, so there is nothing we can call that would tell you something true. Your credentials are stored and the tile shows them as saved, not yet confirmed.
This is a deliberate choice over the alternative. A check written against a guessed endpoint reports a good credential as unverified, and then nobody can tell whether the credential or the guess was wrong. An honest “we have not confirmed this” is more useful than a red mark that means nothing.
Access control
- Settings: Edit is required to connect or disconnect
- Integrations: View is required to see the Integrations page and connection status
- All endpoints are authenticated through your License Logic session
Data retention
Credentials are retained until you disconnect, at which point they are deleted from the database outright rather than disabled behind a flag.
Revoking or regenerating the key in MasterControl stops the connection immediately, whether or not you also disconnect in License Logic. Doing both is the complete removal.
For more about License Logic’s security practices, see our Security Policy or contact security@licenselogic.co.
Troubleshooting
The tile will say “saved, not yet confirmed”, and that is correct. License Logic does not test MasterControl credentials at connect time, because there is no published endpoint we have been able to read documentation for. An unconfirmed connection here is not a fault and does not need reporting.
We cannot find where to generate an API key
This is the most likely obstacle, and it is a MasterControl question rather than a License Logic one. Their support team, or your account manager, can point your administrator at the right screen for your version. Their Integrations: Send API Calls training also covers it. If API access is not included in your subscription, that is the answer — and worth establishing early.
Is the API Toolkit included in our subscription?
Ask your MasterControl account team. It varies by agreement, and some customers already hold it without realising. We cannot determine this from our side.
Connected, but no data has appeared yet
Your first sync is scheduled once your connection is confirmed, so data appears shortly after rather than the instant you click Connect. If the tile shows the connection as verified, the credential side is done. If nothing has appeared after your first scheduled sync, contact support and we will look at the run.
The Connect button does nothing, or the tile is missing
This is almost always permissions on the License Logic side. Integrations: View shows the page; Settings: Edit is required to connect. Ask your License Logic administrator to check both in People → Roles.
Frequently Asked Questions
Does License Logic receive a MasterControl password?
No. The connection uses an API key generated inside MasterControl. It can be revoked at any time without affecting any user account.
Can License Logic change anything in MasterControl?
No. The integration reads user and licence information. It does not create, edit or delete documents, records, users or configuration. Today it does not read anything at all. This matters more here than for most systems, because MasterControl typically holds validated quality records — License Logic is a read-only consumer of user and licence data, and is not part of your quality system.
Why does the tile not confirm our credentials?
MasterControl does not publish a health endpoint we can call to check a key without documentation from your own instance, so the tile records the credential as saved rather than showing a check we did not really perform. The first sync is what confirms it.
What happens if we disconnect?
The stored API key is deleted from License Logic, and any MasterControl data already synced is removed with it. Your MasterControl account itself is untouched — the key remains valid there until you revoke it.
Support
If you need help with the MasterControl integration:
- Email: support@licenselogic.co
- In-app chat: click the chat icon in the bottom-right corner of License Logic
- Security questions: security@licenselogic.co
When contacting support, please include your company name, your MasterControl site URL, and a description of the issue. Never send a credential by email — if we need to look at a connection, we can do so from our side.
If you would like to be told when the sync for this integration is enabled, say so and we will add you to the notification list for it.