> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ThreatLocker

> Connect ThreatLocker to Triggr with the API token of a ThreatLocker API user.

Triggr works with ThreatLocker computers, maintenance mode, approval requests, logs and audits, applications, policies, tags and scheduled agent actions.

## Set up ThreatLocker

<Steps>
  <Step title="Create a role for Triggr">
    In **Users > Roles**, click **+ New Role**, name it `Triggr`, tick the permissions your workflows need and click + Create Role. Create it in the organisation where you'll create the API user.

    | Workflows will | Permissions |
    | - | - |
    | Find and read computers | View Computers |
    | Edit, restart, rescan, or enable or disable protection | Edit Computers |
    | Change maintenance mode | Edit Computers plus that mode's permission, such as Manage All Maintenance Modes |
    | Read approval requests | View Approvals |
    | Approve applications | Approve for Entire Organization, Approve for Group or Approve for Single Computer, plus Approve for New Install or Approve for Update Existing. Elevation also needs Elevation Administrator. |
    | Read or generate an auth key | Edit Computers and Install Computers |

    Other endpoints list their permissions under Help > API Documentation in the portal. See ThreatLocker's [user permissions](https://threatlocker.kb.help/user-permissions/) guide.
  </Step>

  <Step title="Create an API user">
    Select the Manage icon, go to **Users > API Users** and click **New API User**. Name it `Triggr` with Basic Authentication (API Token), not OAuth 2.0; click Generate API Token and copy the token (ThreatLocker won't show it again); add the `Triggr` role and leave Organization empty to cover every organisation. Tick Accept EULA and click Create. See ThreatLocker's [API Users](https://threatlocker.kb.help/api-users/) guide.
  </Step>

  <Step title="Find your instance">
    Select Help in the portal. Your instance letter, such as `g`, is next to ThreatLocker Access. See [Locating Your Organization's Instance](https://threatlocker.kb.help/locating-your-organizations-instance/).
  </Step>
</Steps>

## Connect it in Triggr

<Steps>
  <Step title="Open the configuration">
    Go to **Integrations > ThreatLocker** and click **Configure** on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the token and instance">
    Paste the token alone into API Key, with no `Bearer`, and enter just the letter as Instance/Region. Leave Managed Organization ID blank to work in the API user's own organisation, or enter an Organization ID (from Manage > Organizations) to scope Triggr to that one. Click Save Configuration.

    <Frame>
      <img src="https://mintcdn.com/triggr/rFRD51HB_88hTzdJ/images/threatlocker/configure.png?fit=max&auto=format&n=rFRD51HB_88hTzdJ&q=85&s=f17c0a4879359cee4731ffc91ba37ea2" alt="The ThreatLocker configuration window with API Key, Instance/Region and an optional Managed Organization ID field, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1354" data-path="images/threatlocker/configure.png" />
    </Frame>
  </Step>
</Steps>

There's no client mapping. To work across clients' organisations, create the API user in your top-level organisation with the role in every organisation and leave Managed Organization ID blank; many actions then take an organisation ID or a child-organisations option, such as `childOrganizations` on List Computers.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Every action fails with 403 Forbidden">
    ThreatLocker didn't accept the token. Check Instance/Region matches the letter under Help, API Key holds the full token alone, and the API user uses Basic Authentication (API Token).
  </Accordion>

  <Accordion title="Some actions fail with 401 Unauthorized">
    The `Triggr` role lacks a permission the endpoint needs. Add it, then retry.
  </Accordion>

  <Accordion title="Results come from the wrong organisation">
    Managed Organization ID scopes every action to that organisation. Otherwise, add the role to more organisations, and use View Computers rather than View Computers - Managed Organization Only.
  </Accordion>

  <Accordion title="The API token was lost or expired">
    In Users > API Users, use Reset API Token on the `Triggr` user and copy the new token. In Triggr, click Edit on the Base Configuration card and paste it into API Key.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.