T-Hub: integrate with any system for identity and entitlement discovery, provisioning and deprovisioning
Connect anything. Automate everything. Audit everything.
T-Hub is the integration backbone of the SecurEnds IGA platform. Built on SCIM 2.0 and REST, it discovers identities and entitlements in every connected system and turns governance decisions into real-time provisioning and deprovisioning across SaaS, on-premises, custom-built and legacy systems.
One Integration Layer Between Governance and Every System You Run
T-Hub sits between the SecurEnds IGA platform and your applications. Decisions come in from governance, HR and ticketing. T-Hub transforms and routes each one to the right system using the right method, confirms the change, and sends current accounts and entitlements back for the next review.
Decisions Come In
- SecurEnds IGA — Access requests, review revocations, policy actions
- HR systems — Joiner, mover and leaver events from Workday, SuccessFactors, ADP
- ITSM — Approved tickets from ServiceNow, Jira Service Management
- Time-bound access — Just-in-time and emergency windows that expire
T-Hub Engine
SCIM 2.0 · REST · 100+ connectors
- Receive → Transform → Route → Fulfill → Prove
- Visual canvas — Drag-and-drop flows with live status, queue depth, retries and failures
- Connectors — Prebuilt connectors plus REST, SOAP, LDAP, JDBC, SFTP, SMTP and flat-file processors
- Logic — Groovy, Python and JavaScript processors, conditions and time-bound entitlements
- Transformation — Map and enrich between JSON, XML, CSV, SCIM and flat files
- Audit log — Request ID, approver, timestamp, target, action and completion evidence
Cloud SaaS · On-premises agent · Hybrid · Multi-tenant for partners
Access Changes Go Out
- Directories — Active Directory, Entra ID, Okta
- SaaS and cloud — Salesforce, Microsoft 365, GitHub, AWS IAM
- Databases — Oracle, SQL Server, Snowflake
- Legacy — Mainframe / RACF, SAP ERP, flat files, RPA
Bi-directional: Current accounts and entitlements flow back into SecurEnds, so every review starts from what is actually in each system.
Turn Identity Governance Decisions Into Access Changes
Most identity governance tools can decide who should have access. The challenge begins when that decision must become a change inside the target application. T-Hub closes that gap with a flexible, language-independent integration layer that connects SecurEnds to directories, SaaS applications, databases, ITSM tools and legacy systems, without waiting for a vendor connector or a core platform release.
Real-Time Provisioning
Provision and deprovision access using SCIM 2.0 and REST as governance decisions are approved.
Low-Code Integration
Build and maintain integrations visually, without heavy engineering for every application.
Bi-Directional Data Flow
Push access changes to target systems and pull current accounts and entitlements back into governance.
Connector Independence
Onboard applications without waiting for a vendor connector roadmap.
Full Audit Trail
Keep the decision, fulfillment action, target system, approver and completion evidence connected.
Flexible Deployment
Run T-Hub as cloud SaaS, through an on-premises agent, or as a hybrid model.
Reduce the Manual Work Between Approval and Access Change
The result of manual fulfillment is orphaned accounts, audit findings, delayed onboarding and access that stays active longer than intended.
How T-Hub Automates It
Receives approved governance decisions and fulfills them in the target system in real time.
Listens for HR joiner, mover and leaver events and updates connected systems.
Turns access review revocations into deprovisioning actions that are confirmed and logged.
Reaches API-less legacy systems through JDBC, flat files, SFTP and RPA hooks.
Opens and auto-closes ITSM tickets so approvals, fulfillment and change management stay aligned.
The net result: Access changes happen when decisions are made, across the systems in scope, with evidence of what happened.
From Governance Decision to Confirmed Provisioning
One workflow for access requests, lifecycle events, access review revocations and other governance actions.
Receive
An approved access request, lifecycle event, review decision or governance action.
Transform
Map and enrich identity, account, entitlement and application data into the format the target needs.
Route
Send the change through SCIM 2.0, REST, SOAP, LDAP/LDAPS, JDBC, SFTP, ITSM or files.
Fulfill
Create, update, suspend, provision or revoke access based on the approved decision.
Monitor
Track flow status, queues, retries, failures and fulfillment activity.
Prove
Retain request ID, approver, timestamp, target, action type and completion evidence.
See How T-Hub Connects Governance to Provisioning
Watch approved governance decisions move through T-Hub into provisioning, deprovisioning and application-level fulfillment across modern, custom, on-premises and legacy systems.
Build Provisioning Workflows Around the Systems You Already Use
Standards-based identity provisioning, combined with an extensible integration framework for modern and hard-to-connect applications.
Standards-Based Provisioning
SCIM 2.0 and REST for real-time joiner, mover and leaver provisioning and deprovisioning.
Low-Code Visual Builder
Build on a drag-and-drop canvas while monitoring flow status, queue depth and failures.
Prebuilt and Extensible Connectors
100+ out-of-the-box connectors plus REST, SOAP, JDBC, SFTP, SMTP and flat-file processors.
Custom Workflow Logic
Groovy, Python or JavaScript processors, conditional logic, retries and time-bound entitlements.
Visual Data Transformation
Map, enrich and route data between JSON, XML, CSV and SCIM without preprocessing scripts.
Legacy Application Enablement
Bring mainframe and API-less applications into governance without re-platforming them.
ITSM and Ticketing
ServiceNow, Jira Service Management, Freshservice, Zendesk and more, with tickets that open and close automatically.
Full Auditability
Every action logged with request ID, approver, timestamp, target and action type.
Remove the Bottlenecks That Leave Access Changes Unfinished
Slow Access Fulfillment
Approved requests wait on tickets and manual steps.
Provision in Real Time
Receives the approved decision and provisions through SCIM or REST in real time, with no extra hand-off.
Lingering Access After Exit
Leavers and role changes leave accounts or permissions behind.
Trigger Deprovisioning
HR events trigger deprovisioning across connected systems as lifecycle events occur.
Waiting on Connectors
New applications sit behind vendor connector roadmaps.
Build the Required Integration
The extensible processor framework with REST, SOAP, JDBC and SFTP lets teams build the integration.
Legacy Systems Outside Governance
Mainframes and API-less apps depend on manual processes.
Bring Legacy Into the Lifecycle
JDBC, flat-file, SFTP, script processors and RPA hooks bring them into the same automated lifecycle.
Weak Audit Evidence
Proving who approved access and what changed means manual reconstruction.
Retain Traceable Evidence
Every action keeps a request ID linked to the approver and decision, with exportable logs.
Standing Privileged Access
Emergency or temporary access stays active past the approved period.
Expire Access Automatically
Just-in-time and time-bound entitlements revoke automatically when the window closes.
Provision and Deprovision When Identity Events Occur
Joiners · Create
Provision accounts and approved access as employees or contractors join.
Movers · Update
Adjust access when users change role, department, location or responsibilities.
Leavers · Deactivate
Trigger deprovisioning when employment or a third-party relationship ends.
Access Requests · Grant
Turn approved requests into fulfillment actions in the target application.
Review Revocations · Revoke
Convert revoke decisions into deprovisioning, tied to the original review.
Temporary Access · Expire
Grant time-bound access and revoke it automatically when the window expires.
Use the Protocols and Data Formats Already in Your Environment
Modern identity systems, SaaS, cloud, databases, ITSM and legacy applications, in one governance process.
Supported Protocols
Supported Data Formats
Directories & Identity
- Active Directory
- Microsoft Entra ID
- Okta
- PingIdentity
- OneLogin
- ForgeRock
- JumpCloud
SaaS & HCM
- Workday
- SAP SuccessFactors
- Salesforce
- ADP
- UKG
- Google Workspace
- Microsoft 365
- GitHub
Databases & Storage
- Oracle
- SQL Server
- PostgreSQL
- MySQL
- Snowflake
- Amazon S3
- Azure Blob
ITSM & Ticketing
- ServiceNow
- Jira Service Management
- Freshservice
- Zendesk
- Ivanti
- ManageEngine
Cloud & PAM
- AWS IAM
- Azure RBAC / PIM
- Google Cloud IAM
- Delinea Secret Server
Custom & Legacy
- Generic REST / SOAP
- JDBC
- SAP ERP
- Mainframe / RACF
- Flat files
- RPA hooks
Use SCIM where it fits. Use the right integration method where it does not.
Four Capabilities That Keep Fulfillment Moving
Real-Time
Governance decisions become provisioning and deprovisioning actions as they are made.
Low-Code
IAM analysts build and monitor integrations on a visual canvas.
Auditable
Traceability from the governance decision through confirmed fulfillment.
Independent
Deploy and update integrations on your own schedule, outside SecurEnds core releases.
Connect Cloud and On-Premises Systems Without Forcing One Architecture
Use T-Hub as a cloud-hosted service for supported integrations.
Reach applications and infrastructure that must stay inside the enterprise network.
Combine cloud identity governance with on-premises connectivity where required.
Keep the Access Decision and Fulfillment Evidence Together
Provisioning is not complete when an approval is recorded. Audit teams need proof the approved action actually happened.
Every Action Can Record
- Request ID
- Approver
- Timestamp
- Target system
- Action type
- Fulfillment status
- Retry or failure activity
- Completion evidence
Reduce Integration Work Without Reducing Governance Control
Faster Time to Value
Build or change integrations without waiting on engineering teams or vendor roadmaps.
Lower Integration Cost
Reusable visual workflows let IAM teams maintain integrations without a developer for every change.
Stronger Security and Compliance
Remove access faster, reduce orphaned accounts and keep audit-ready fulfillment records.
Scalable Delivery
One repeatable integration pattern across SecurEnds-led and partner-led deployments.
T-Hub Questions, Answered
What is T-Hub?
T-Hub is the integration hub of the SecurEnds IGA platform. It connects governance decisions to target systems using SCIM 2.0, REST and other supported standards, so access can be provisioned, changed and removed automatically.
What is SCIM provisioning?
SCIM (System for Cross-domain Identity Management) is a standard API for creating, updating and deleting user accounts and related identity information across systems. T-Hub uses SCIM 2.0 to automate these provisioning and deprovisioning actions.
Does T-Hub work with applications that don't support SCIM?
Yes. T-Hub also supports REST, SOAP, LDAP, JDBC, SFTP, flat files and RPA hooks for systems that do not support SCIM or do not expose a modern API.
How does T-Hub handle joiners, movers and leavers?
T-Hub listens for HR lifecycle events from systems such as Workday or SAP SuccessFactors. These events trigger provisioning, access changes or deprovisioning across connected systems.
Do I need developers to build integrations?
Standard workflows are built on T-Hub's drag-and-drop visual canvas. When custom logic is needed, script processors using Groovy, Python or JavaScript are available.
Which ticketing systems does T-Hub support?
ServiceNow, Jira Service Management, DeskPro, Freshdesk, Ivanti, Zendesk, Freshservice and other ticketing platforms. Tickets can be created and closed automatically as fulfillment completes.
Can T-Hub support temporary or emergency access?
Yes. T-Hub supports just-in-time and time-bound entitlements that revoke automatically when the approved access period ends.
How are actions audited?
Each action records the request ID, approver, timestamp, target system and action type. Logs can be exported as evidence for SOC 2, SOX, HIPAA and PCI DSS audits.
How can T-Hub be deployed?
As cloud-hosted SaaS, with an on-premises agent, or as a hybrid deployment.
What is the difference between SCIM and REST API provisioning?
SCIM provides a standardized schema and API for user and group lifecycle operations, so SCIM-enabled applications follow one consistent model. REST integrations use each application's own API, which varies by vendor. T-Hub supports both and can transform data between formats such as JSON and SCIM 2.0.
How do I provision access to a legacy or mainframe application with no API?
T-Hub reads and writes databases through JDBC, exchanges flat files and batch imports over SFTP, runs script processors for systems such as mainframe and RACF, and uses RPA hooks for disconnected applications, without re-platforming.
What happens if a provisioning or deprovisioning action fails?
Retry-on-failure logic is configured in the T-Hub canvas. The live view shows failures and backlogs, and each action stays tied to its original request ID so teams can trace a failure back to the governance decision.
Can I add a new integration without waiting for a SecurEnds release?
Yes. T-Hub runs independently of SecurEnds core release cycles. Teams build integrations with the extensible processor framework and deploy or update them on their own schedule.
Can partners use T-Hub to manage integrations for multiple customers?
Yes. T-Hub supports a multi-tenant model with tenant isolation, so partner-led and SecurEnds-led implementations use the same standardized delivery pattern.
Close the Gap Between Governance Decisions and Execution
Schedule a T-Hub walkthrough with a SecurEnds solutions engineer. See the visual canvas, review your target systems and discuss how provisioning and deprovisioning fit your environment.