# Coupa

![Coupa logo large (transparent PNG)](https://assets.relyanceuat.xyz/images/docs/35099412921485/ext-2c0011d4a2.png)
Coupa is a cloud-based spend management platform that helps businesses manage procurement, invoicing, expenses, and supply chain processes.

To connect Coupa to Relyance you will need Instance Name, Client Secret and Client ID.

#### In Coupa:

1. To get the **Instance Name**: Check the URL: When you log into Coupa, look at your browser’s address bar: https://`<instance-name>`.coupahost.com/ **Example:** If the URL is https://acme.coupahost.com, then the instance name is: **acme**
2. Follow the [Set Up an OpenID Connect Client](https://compass.coupa.com/_dita_/en-us/documentation/plat/integ/coupa_core_api/topics/set_up_oidc_client.dita) article to generate **Client Secret** and **Client ID.**

#### In the Relyance AI application:

![Screenshot](https://assets.relyanceuat.xyz/images/docs/35099412921485/41212559824909.png)
1. Login to your Relyance account.
2. Navigate to the Settings (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Coupa** integration card and click on **Add Connection**.
5. Scroll down until the **Connection Settings** section.
6. Choose your settings accordingly and **Click Continue**.
7. On the **Edit Connection** section, Choose **Custom** under **Authentication Method**. Complete the **Instance Name**, **Client ID** and **Client Secret** fields retrieved from the previous step-by-step.
8. Click **Authenticate** and confirm the integration Status reflects **Connected**.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/35099412921485/41212578267149.png)

<!-- failure-modes:begin (generated from the integration catalog; do not hand-edit) -->

## If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. **A credential rotated at the vendor is not picked up here.** **Client Secret** is stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
2. **Check the address fields before suspecting the credentials.** **Instance name** identifies which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

<!-- failure-modes:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "coupa" {
  vendor = "coupa"
  name   = "<your connection name>"

  auth = {
    method = "client-credentials"
    params = {
      instance_name = "<instance_name>"
      client_id = "<client_id>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      client_secret = var.coupa_client_secret
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->