Ironclad
Connect Ironclad so Suger AI can work with your contract workflows, records, and signatures.
Overview
Ironclad is a contract lifecycle management platform covering workflow-driven contract creation, approvals, signature, and a searchable repository. Connecting it lets the Suger AI agent drive contract workflows and read your records repository from a Suger workflow or chat.
Org-Level vs User-Level
Org-Level: Supported, using the OAuth 2.0 client-credentials grant against your own Ironclad environment.
User-Level: Not currently available. Ironclad’s OAuth client is registered inside your own account rather than centrally, so there is no single Suger app your users could sign in to.
How the connection works
The OAuth client is registered in your Ironclad environment, not centrally by Suger. Suger exchanges its client ID and secret for an access token against your environment and refreshes it as needed. Ironclad also requires an acting user on every request, which is why the connect form asks for one.
Create Integration (Org-Level)
Prerequisites
- An Ironclad account with API access.
- Permission to register an OAuth client (Company Settings → API).
- An Ironclad user whose identity Suger should act as. Ironclad requires an acting user on every API request, so this is not optional.
- The Suger Admin role — connecting, disconnecting, and running an integration’s actions are all admin-only in Suger.
Authenticate by client credentials
- In Ironclad, register a new OAuth client and grant it the scopes you want Suger to have. Ironclad’s scopes are per resource and action — for example
public.workflows.createWorkflows— so a missing scope makes the matching tool fail. See Register an OAuth client. - Copy the Client ID and Client Secret.
- In the Suger console, open Settings → Integrations and click Connect on Ironclad.
- Enter:
- Client ID and Client Secret — from step 2.
- Environment —
na1,demo, oreu1, matching your Ironclad tenant. - Acting user email — the Ironclad user Suger makes requests on behalf of.
- Save.
Suger AI Tools
When Ironclad is connected, the Suger AI agent can drive contract workflows through Suger’s built-in tools (46 actions).
Org-level: Every tool runs as the acting user configured above, within the scopes granted to your OAuth client. A permission error means one or the other is too narrow.
| Capability | What the agent can do |
|---|---|
| Workflows | Create a workflow (synchronously or async), read it, and list workflows; update its attributes (e.g. create-workflow, create-workflow-async, update-workflow-attributes) |
| Workflow lifecycle | Pause, resume, cancel, or revert a workflow to review (e.g. pause-workflow, revert-to-review-workflow) |
| Approvals | List a workflow’s approvals and approval requests, and record a decision (e.g. list-workflow-approvals, update-approval-status) |
| Signatures | Send a signature request, check signing status, and list signatures (e.g. send-signature-request, get-sign-status) |
| Documents | List and download the documents attached to a workflow (list-workflow-documents, download-workflow-document) |
| Comments & history | Add and list workflow comments, and read participants and turn history (e.g. create-workflow-comment, list-workflow-turn-history) |
| Schemas | Read and list workflow schemas, and list eligible assignees (e.g. get-workflow-schema, list-eligible-assignees) |
| Records | Create, read, replace, rename, delete, and list repository records; read metadata, run a record action, and export to XLSX (e.g. create-record, run-record-action, export-records-xlsx) |
| Entities | Create, read, update, delete, and list entities, and read relationship types (e.g. create-entity, list-entity-relationship-types) |
| Webhooks | Create, read, update, delete, and list webhooks, and fetch the verification key (e.g. create-webhook, get-webhook-verification-key) |
Edit Integration
Editing is not supported. To change the acting user, rotate the client secret, or switch environments, delete the integration and create it again.
Delete Integration
Click the 🗑️ button next to Ironclad in the Integrations list. The stored client pair is destroyed with the integration record. Revoke the OAuth client in Ironclad too if you want to cut access from that side.
Spotted something wrong or out of date on this page? Tell us and we'll correct it.