---
name: "directory_connect"
area: "directory"
title: "Connect the directory"
price: "$0.001"
method: "POST"
url: "https://api.conecto.chat/v1/tools/directory_connect"
mcp_server: "https://api.conecto.chat/mcp/directory"
auth: "Authorization: Bearer <conecto_sk_ key>"
docs_url: "https://conecto.chat/tools/directory/directory_connect"
---

# Connect the directory (`directory_connect`)

Connects the company's Microsoft Entra ID or Okta, checked by reading one person.

Connect the company's Microsoft Entra ID or Okta. Entra ID: tenant_id, client_id and the client secret of an app registration with User.ReadWrite.All and GroupMember.ReadWrite.All (and User.EnableDisableAccount.All), consented by the tenant's admin. Okta: org_url and an admin's API token. The connection is checked by reading one person. Suspensions then wait for the owner's approval by default.

Price: $0.001 a call. A call that fails costs nothing.

## Use it when

The business wants joiners and leavers handled in its directory.

## Say this to your agent

> Connect our Okta so you can set up new hires. Here is the API token from our admin.

## Inputs

| Name | Type | Required | Description | Allowed values | Default |
|---|---|---|---|---|---|
| `provider` | string | yes |  | `"entra"`, `"okta"` |  |
| `tenant_id` | string | no | Up to 120 characters. |  |  |
| `client_id` | string | no | Up to 120 characters. |  |  |
| `org_url` | string | no | Up to 200 characters. |  |  |
| `secret` | string | yes | The Entra client secret or the Okta API token. Never shown again. 8 to 2,000 characters. Stored encrypted and shown only as [redacted]. |  |  |

## Example

Written for Hansen & Voss, a restaurant-equipment wholesaler in Hamburg with 60 staff.

MCP: call `directory_connect` on the MCP server `https://api.conecto.chat/mcp/directory` with these arguments:

```json
{
  "provider": "okta",
  "org_url": "https://hansenvoss.okta.com",
  "secret": "00aBcD-example-token"
}
```

REST:

```bash
curl https://api.conecto.chat/v1/tools/directory_connect \
  -H "Authorization: Bearer $CONECTO_KEY" \
  -H "Content-Type: application/json" \
  -d '{"provider": "okta", "org_url": "https://hansenvoss.okta.com", "secret": "00aBcD-example-token"}'
```

## Response

```json
{
  "call_id": "5f0c8a2e-3b7d-4c1e-9a64-2d8e1f7b0c93",
  "tool": "directory_connect",
  "status": "succeeded",
  "replayed": false,
  "cost_usd": "$0.001",
  "balance_usd": "$19.75",
  "result": {
    "directory": {
      "provider": "okta",
      "tenant_id": null,
      "org_url": "https://hansenvoss.okta.com",
      "connected_at": "2026-10-14T08:00:00+00:00"
    },
    "suspensions_need_approval": true
  }
}
```

`result`: directory: the provider, the tenant or org and when it was connected; suspensions_need_approval when an approval rule for suspensions was made.

## Errors

| Code | Status | When | Fix |
|---|---|---|---|
| `invalid_input` | 400 | Entra ID was given without tenant_id or client_id, or org_url is not an Okta org. | Give what the message names. |
| `directory_rejected` | 502 | The directory refused, usually because a permission is missing. | Ask its admin to grant what the message names. |
| `directory_unavailable` | 503 | The directory could not be reached. | Try again in a minute; nothing changed. |

The refusals every tool can give (401 key, 402 balance, 429 limits) are on the errors page: https://conecto.chat/docs/errors.md

## Related

- [directory_list_users](https://conecto.chat/tools/directory/directory_list_users.md): People in the directory with their name, email, title, department and whether they can sign in. Free up to 1,000,000 reads a month.
- [directory_get_user](https://conecto.chat/tools/directory/directory_get_user.md): One person in the directory by id or email. Free up to 1,000,000 reads a month.
- [directory_list_groups](https://conecto.chat/tools/directory/directory_list_groups.md): The directory's groups with their id, name and description. Free up to 1,000,000 reads a month.
- [directory_create_user](https://conecto.chat/tools/directory/directory_create_user.md): Opens a joiner's account with their title, department and groups; no password passes Conecto. $0.25 a call.
- [directory_update_user](https://conecto.chat/tools/directory/directory_update_user.md): Changes a person's title, department or manager in the directory. $0.01 a call.
- [directory_set_groups](https://conecto.chat/tools/directory/directory_set_groups.md): Adds a person to groups and takes them out of others. $0.01 a call.
- [directory_suspend_user](https://conecto.chat/tools/directory/directory_suspend_user.md): Blocks a leaver's sign-in and ends their sessions, after the owner approves by default. $0.25 a call.
- [directory_restore_user](https://conecto.chat/tools/directory/directory_restore_user.md): Lets a suspended person sign in again. $0.001 a call.
- [directory_sync_from_hr](https://conecto.chat/tools/directory/directory_sync_from_hr.md): Sets titles and departments in the directory as HR has them; dry_run shows the plan first. $0.01 a call.
- [directory_disconnect](https://conecto.chat/tools/directory/directory_disconnect.md): Forgets the directory's credentials; nothing in the directory changes. Free.