Tulip connects to multiple Security Applications (such as Okta, Jamf Pro, Microsoft Entra ID and more). You can connect to multiple separate instances of each application (such as “Production”, “Staging” and “Dev”).

Tulip fetches the configuration of those Application Connections into NaCl files, allowing you to compare the different app connections, and deploy changes between them.

NaCl is a structured, declarative and human-readable configuration language, designed to describe SaaS applications' configuration and the relationships between different configuration elements.

A Tulip application connection represents a single SaaS application account connection, e.g., Okta, Jamf Pro. Each connection links to a specific account or instance of that SaaS application, e.g., a specific sandbox account.

A typical Tulip application connection represents a real world environment, e.g., "Production", "Staging" and "Dev".
Application connections are shared and accessible to all of your Tulip organization members.

Fetch updates your Tulip app connection configuration data based on the current status of your SaaS applications that are linked to the environment. During a fetch operation Tulip connects to the linked SaaS application accounts via their APIs, reads their configuration, and translates them to NaCl files. Learn more here.

Deploy updates your SaaS applications configuration data, with changes selected by the user. A deployment can contain changes from another app connection (e.g. deploying a change from Staging to Production), restore configuration from a previous snapshot, or revert specific changes. During a deploy operation, Tulip connects to the application's SaaS application accounts via their APIs and updates their configuration based on the selected changes.