Coupa
Connect Coupa to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Coupa to collect vendor procurement evidence with automated compliance tests, switched on per workspace.
| Category | Vendor Procurement |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Coupa's guide | compass.coupa.com |
Connect with an API token
-
In Coupa:
- Sign in to your Coupa instance and go to Setup › Oauth2/OpenID Connect Clients (/oauth2/clients).
- Click Create.
- From the Grant type dropdown, select Client Credentials.
- Complete the fields and select only the scopes (access permissions) Safeguard needs.
- Save. Note the client credentials: Identifier (client ID), Secret (client secret) and Oidc Scopes. Paste the Identifier into Safeguard's Client ID (optional) field and the Secret into Client secret (optional).
- Alternatively, request a token from https://<INSTANCE_DOMAIN>/oauth2/token with these client credentials and paste it into Access token; it is valid for 24 hours.
Where to find the other values:
- Instance URL: Your Coupa instance domain, the same host used in the token endpoint https://<INSTANCE_DOMAIN>/oauth2/token (an address under coupahost.com).
Coupa's public documentation does not cover every step.
Access tokens last 24 hours (expires_in 86,399), so the client ID and secret are the durable credential. Not verified: the scope name for reading users (core.user.read was in the research but appears on neither fetched page) and the Coupa permission needed to reach Setup. The page does not say whether the secret can be viewed again later.
Source: compass.coupa.com, compass.coupa.com, checked 2026-10-07.
The permissions Safeguard needs:
core.user.read. -
On Compliance › Connectors, open Coupa, click Connect, choose API token and fill in:
Field What to enter Instance URL Optional. An address under coupahost.com. Access token Optional. Stored encrypted and never shown again. Or, instead: Client ID (optional), Client secret (optional).
-
Click Connect with token.
Frameworks
Safeguard's automated tests read Coupa and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vendor Procurement connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks