> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getunbound.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Settings
> Provider keys, devices, integrations, enforcement behaviour and webhooks
| | |
| ----------- | ------------------------------------------------------------------------------- |
| **URL** | `/settings` |
| **Sidebar** | Settings |
| **Roles** | Admin · Analytics Viewer · Manager, who sees the **Provider API Keys** tab only |
Settings holds your organization's configuration. Five tabs, each carried in the URL as `?tab=`.
## What's on the page
### Tabs
| Tab | `?tab=` | Roles |
| ---------------------- | -------------------- | ---------------------------------- |
| **Provider API Keys** | `provider-api-keys` | Admin · Analytics Viewer · Manager |
| **Devices** | `devices` | Admin · Analytics Viewer |
| **Integrations** | `integrations` | Admin · Analytics Viewer |
| **Policy Enforcement** | `policy-enforcement` | Admin · Analytics Viewer |
| **Webhooks** | `webhooks` | Admin · Analytics Viewer |
### Provider API Keys
The model providers you bring your own keys for, so Unbound can reach them on your behalf. Separate from the key a developer uses to connect a coding tool, which is on [Configure](/dashboard/configure).
| Column | Contents |
| -------------- | --------------------------------------------------------------------- |
| **Name** | What the key is called. Keys Unbound supplies are tagged **Built-in** |
| **Created At** | When it was added |
| **Created By** | Who added it · **Unbound** for a built-in key |
| **Provider** | The model provider it reaches |
### Devices
| Column | Contents |
| ----------------- | --------------------------- |
| **Serial Number** | Its hardware serial |
| **Device Name** | The machine's name |
| **User** | The developer it belongs to |
| **Email** | Their address |
**Import Devices** brings in a list of machines in one step, such as an export from your MDM. The file is CSV or Excel (`.csv`, `.xlsx`, `.xls`), up to **10 MB**, dropped on the dialog or browsed for.
| Column | Required | Headers accepted |
| --------------- | -------- | ------------------------------------------------------------------------ |
| `serial_number` | Yes | `serial_number`, `serialnumber`, `serial` |
| `email` | Yes | `email`, `user_email`, `useremail` |
| `device_name` | Optional | `device_name`, `devicename`, `name` |
| `first_name` | Optional | `first_name`, `firstname`, `given_name`, `givenname`, `fname` |
| `last_name` | Optional | `last_name`, `lastname`, `family_name`, `familyname`, `surname`, `lname` |
Header names are matched loosely — capitalization, spaces and dashes make no difference, so `Serial Number`, `serial-number` and `serial_number` all work. A header spelled any other way is not recognized, and its values do not arrive. A row without a serial and a valid email address is skipped, and only the first sheet of an Excel workbook is read. The dialog previews the first five rows with the total, so you can confirm the file read correctly before anything is imported — **Change File** goes back. Importing reports **N devices added**, **N devices updated** and, where they occur, the devices that could not be reached and the ones skipped, each skipped row listed with its reason. **Retry N Failed** re-runs just the rows that did not land.
### Integrations
Connects Unbound to the tools around it, split into **Connected** and **Available**:
| Integration | For |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **JumpCloud** | Resolves a device's owner from its serial during an MDM rollout, so you need no imported device list — see [Connect MDM Provider](/mdm-integrations/overview) |
| **Slack** | Approvals via Slack DM — the requests a Require Slack Approval policy sends |
| **Anthropic** | Import chats from claude.ai, through Anthropic's [Compliance API](/integrations/compliance-api-integration) |
| **Okta** | Sync your Okta directory, so managers, departments and titles come from your IdP · shown only where your organization has it turned on |
A connected card shows when it last synced. Okta adds a **Sync** button and an attribute mapping you can edit, and the first import runs as soon as you connect.
**While an MDM integration is connected, device owners come from it.** A serial JumpCloud does not know appears in [Users](/dashboard/users) as a placeholder row named after that serial — importing the device list on the **Devices** tab does not cover it. Before you connect, confirm JumpCloud knows every serial you are rolling out to, or expect serial-numbered rows in [Users](/dashboard/users) for the ones it does not.
#### What Okta sync does
| | |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **When** | Daily at **00:00 UTC**, on **Sync** on demand, and immediately after you change the attribute mapping |
| **What it maps** | **Manager**, **Department** and **Title** only. Which Okta profile attribute feeds each one is the mapping you edit |
| **What a sync changes** | A value present in Okta sets or refreshes the Unbound value; a **blank** Okta attribute leaves whatever is already there, so a sync never clears a field |
| **Who it touches** | People who already have an Unbound account. It never creates users, and it skips placeholder rows |
| **Suspensions** | Someone marked suspended in Okta is suspended in Unbound. Reactivation is not mirrored — going active again in Okta will not reinstate them here |
| **Ceiling** | The first **50,000** directory users |
If the API token is revoked or expires, the card shows the integration as **Inactive** and syncing stops. Reconnect with a fresh token and it resumes at the next sync.
### Policy Enforcement
**If Unbound is unreachable** decides what your agents do when the policy check cannot run:
| Setting | Behaviour |
| --------- | ------------------------------------------------------------------------- |
| **Allow** | *Operations run as usual.* Work continues uninterrupted · **the default** |
| **Block** | *Operations are denied.* Work stops until Unbound is reachable again |
The choice is staged until you press **Save** — an **Unsaved changes** badge marks the gap, and leaving the page first prompts you.
### Webhooks
Sends Unbound events to your own systems — a SIEM, a chat channel, or anything accepting an HTTP POST. Each endpoint carries its own signing secret to reveal and copy, can be enabled or disabled, and keeps a delivery history you can read alongside a **Send test event** control.
## Filters and controls
**Search events…** finds events when subscribing a webhook endpoint. The Devices and Provider API Keys tables each have their own search.
## What you can do
Every tab but **Provider API Keys** needs Admin or Analytics Viewer to read. **Every action below is an Admin action** — an Analytics Viewer, and a Manager on the one tab they reach, see the contents without the controls that change them.
| Action | Result |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Add your Model/Key** | Adds a provider key · Admin action, as is deleting one |
| Delete a provider key | Removes the key permanently **and disables the applications using it**, so move them to another key first. The dialog names the key and asks you to confirm |
| **Import Devices** | Brings in a list of machines from a CSV or Excel file, for matching an MDM inventory · the file contract is above |
| Connect an integration | Opens that provider's authorization, or asks for its API key |
| **Remove** an integration | Deletes the stored credential and stops any further sync. Everything already imported stays — see [Data retention and deletion](/support/data-retention) |
| Set **If Unbound is unreachable** | **Save** applies it, with **Policy enforcement updated** |
| **New Endpoint** | Takes the destination URL and an optional description, the events to subscribe to, and — under **Advanced** — optional **Custom headers** as header and value pairs, sent on every delivery to that endpoint |
**If Unbound is unreachable** is the most consequential setting here. Running as usual keeps developers productive through a network problem; denying operations keeps enforcement absolute. Organizations with strict compliance obligations generally choose to deny.
Budgets are not set here — they are cost policies, under [Policies → Usage](/dashboard/policies/usage).
## Messages you may see
| Message | What it means |
| ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| `Policy enforcement updated` | The enforcement setting was saved |
| `Failed to update setting` | The change was not saved. The previous setting still applies |
| `Failed to create API key` | The provider key was not created |
| `You don't have permission to create API keys` | Creating a provider key is an Admin action |
| `Couldn't connect ` | The integration was not connected. Check the credentials and try again from the card |
| `Failed to add integration` | The Anthropic Compliance API connection was not saved |
| `Failed to connect Slack. Please try again.` | Slack authorization did not complete |
| `Could not read the Okta directory` | The Okta attribute mapping could not be previewed. The existing user list is unchanged |
| `File size exceeds 10MB limit. Please use a smaller file.` | The device import file is too large. Split it and import in parts |
| `Unsupported file format. Please use CSV or Excel (.xlsx, .xls) files.` | The device import file is not one of the accepted types |
| `No valid devices found in the file. Please check the format.` | No row carried both a serial and a valid email address. Check the header names |
| `Failed to import devices` | The import did not run. Nothing was changed, so retrying is safe |
## Related
| Page | For |
| --------------------------------------------- | ------------------------------------------------- |
| [Configure](/dashboard/configure) | The API key developers use for their coding tools |
| [Policies — Usage](/dashboard/policies/usage) | Budgets and spend limits |