Flexera

Overview

The Flexera integration connects the Praetorian Guard Platform (PGP) to Flexera One IT Visibility to ingest your internal IT asset inventory, extending PGP's visibility into your internal environments.

This integration operates in a read-only capacity. PGP authenticates as a Flexera service account, exchanges the credentials for a short-lived OAuth2 access token, and reads device and installed-software inventory. It never modifies data or configuration in Flexera.

Prerequisites

Before setting up the integration, ensure you have:

A Flexera One subscription with IT Visibility (or FlexNet Manager Suite) enabled on your organization
A Flexera One user with the Administrator role on the organization whose data you want to ingest. You will use this account to provision a service account; the service account is what PGP will authenticate as.
Your Flexera Organization ID (a numeric identifier visible in the Flexera One console URL after /orgs/, or under Administration > Organization)
Knowledge of the Flexera data region your tenant is hosted in: North America, Europe, or Asia-Pacific

Creating a Flexera Service Account

Service accounts are the recommended credential type for programmatic API access. They produce a non-rotating client_id / client_secret pair that exchanges for short-lived OAuth2 access tokens.

Sign in to Flexera One as an administrator
Open Administration > Identity & Access Management > Service Accounts
Click Create Service Account
Give it a descriptive name (e.g., praetorian-guard-integration) and an optional description
Assign the service account to your organization and grant it the IT Visibility - Read role (or the broader IT Asset Management role if you want both inventory and license data ingested in the future)
Click Create. Flexera displays the Client ID and Client Secret once. Copy both into a secrets manager -- the secret cannot be retrieved later. If lost, you will need to rotate it.

Reference: Flexera API Key Concepts.

Confirming Your Region and Organization ID

Flexera operates three regional data planes. Your tenant lives in exactly one -- pick the URL that matches the Flexera One console you sign into:

Region	Console URL	Data API base
North America	`app.flexera.com`	`api.flexera.com`
Europe	`app.flexera.eu`	`api.flexera.eu`
Asia-Pacific	`app.flexera.au`	`api.flexera.au`

To find your Organization ID, look at any URL inside the Flexera One console after signing in. It will contain a path segment like /orgs/12345/ -- the number is your organization ID. You can also find it under Administration > Organization.

Setup

In PGP, go to Integrations and click Add Integration
Find Flexera (Preview) in the Cyber Asset Attack Surface category and click it
Fill in the required credentials
Click Submit. PGP will exchange the credentials for an access token and verify it can read installed-software data for the organization. If validation fails, the error message will indicate whether the credentials, organization ID, region, or scope is wrong.

If your enterprise has multiple Flexera organizations (e.g., subsidiaries or regional tenants), repeat the setup for each -- the integration supports multiple connections.

Field Reference

Field	Description	Required
Flexera Organization ID	The numeric organization ID (e.g., `12345`). Becomes the visible label for the connection.	Yes
Client ID	The service-account client ID	Yes
Client Secret	The service-account client secret	Yes
Region	The data region matching your tenant (North America, Europe, or Asia-Pacific)	Yes

Permissions

The service account needs the minimum role required to read device and installed-software inventory:

IT Visibility - Read (minimum) -- grants read-only access to the IT Visibility GraphQL and FNMS REST endpoints used for inventory ingestion

The service account does not need write or administrative permissions. Avoid granting Administrator to the service account -- it is not required and increases blast radius if the credential is compromised.