Veeva Vault access and ingest for Mobile Locker

Use this guide when your organization stores approved commercial or medical content in Veeva Vault PromoMats or MedComms and wants Mobile Locker to import that content for the field team.

This is for Vault administrators and IT teams who can create a user and grant document access. It is not a field-user guide. Marketing or medical operations usually help define which documents should ingest. That can happen after IT creates the account.

How ingest works

After you give us a read-only Vault user, we configure a connection for your Mobile Locker team. A recurring job (not a live Vault webhook) queries your Vault with VQL that matches the library filter we agree with you.

Each matching document becomes a presentation in Mobile Locker. Later approved versions update that same presentation. We do not create a new file for every Vault version.

Which documents we import

We import documents that match all of these:

• They appear in the ingest filter for your connection (status, document type, products, country, CLM flag, tags, and similar criteria as agreed).
• They are in an approved status we treat as ready for the field. Common values are Approved, Approved for Distribution, and Approved for Use. If your lifecycle uses other steady-state labels, tell us. We can add them for your connection.
• The file type is one Mobile Locker can process: PDF, PowerPoint, Word, Excel, or MP4 video.

Product links in Mobile Locker come from the standard Vault product__v field.

How files arrive in Mobile Locker

For each matching document, Mobile Locker downloads a file through the Vault API:

• PowerPoint needs the source file. If the integration user cannot download the source, we cannot import slides as a presentation.
• PDF often uses the viewable rendition. Some connections download the PDF source instead.
• Word and Excel may use the source file or the viewable PDF rendition, depending on the connection.
• Video uses a video rendition when Vault provides one.

That is why the integration user must be able to view content, download source files, and download renditions for documents in the ingest set.

Versions and status changes

• When Vault has a newer approved version, Mobile Locker updates the existing presentation.
• If the latest version is not approved, we keep the latest approved version we can still read (when one exists).
• If the document is Withdrawn or Obsolete, or it no longer has an approved version, Mobile Locker deactivates the presentation so the field team cannot use it.

Create the integration user

Create a dedicated Vault user for Mobile Locker. Do not reuse a person's SSO account. The user must authenticate with a Vault username and password (a password security policy), not SSO, because Mobile Locker uses the Vault REST API session login.

In Vault, go to Admin > Users & Groups > Vault Users and create the user. Use a read-only license and security profile (for example Vault's Read-Only User profile) unless your security team requires a custom profile that is still read-only.

Email and username

Vault treats email and user name as different fields.

• Email: use support+[client]@mobilelocker.com, where [client] is a short name for your company (for example support+acme@mobilelocker.com). Vault sends the welcome message and password-reset mail to this address. Tell your Mobile Locker contact the exact address you used so we receive that mail.
• User name: Vault user names use your Vault domain, for example mobilelocker@yourcompany.com. This is the value we type at API login. It is often not the same as the email field.

Password and security policy

Do not set a password for us or email one. After you create the user, Vault emails the address you configured. We complete setup from that message and generate the password.

The password for this account must not expire. If it expires, ingest stops until we set a new one from a Vault reset email. In Vault, password expiration lives on the security policy (Admin > Settings > Security Policies), in Password and Access Token Expiration. Choose No expiration for this integration user. If your default policy expires passwords, create a policy for API integration accounts and assign it only to this user.

API access

The user's security profile must allow API use. In permission sets this is under Application > API (for example Access API or All API). Without it, browser login can work while the API still fails.

Veeva documents the REST API here: developer.veevavault.com.

Required permissions

The user must be able to see and download every document in the ingest set. Create access, edit access, and workflow access are not required.

Typical Vault permissions:

Add the user to a group that already has a viewer-style role on the commercial or medical document types you ingest. If the user can sign in but VQL returns no rows, Sharing Settings on those documents is the usual cause.

If you restrict Vault or API traffic by IP address, allow the addresses in Mobile Locker IP Addresses.

What to send us

Email support@mobilelocker.com when the user is created. Include:

• The Vault URL (for example https://yourcompany.veevavault.com)
• The Vault user name (the login, not only the email field)
• The email you put on the user (so we know which mailbox to watch)
• Whether this is PromoMats, MedComms, or both (separate users if they are separate Vaults)

Do not include a password. Vault emails that address. We generate the password from that message.

You do not need the library filter in that first email. We often agree the filter later with your primary Mobile Locker contacts in marketing or medical affairs.

Define the ingest filter

In Vault, build a library saved view / filter that shows only the approved documents that should appear in Mobile Locker. Typical criteria:

• Status (approved / approved for distribution / approved for use)
• Document type or subtype (for example Material)
• Product
• Country or language
• CLM or field-use flags, if you use them
• A tag such as "Mobile Locker", if you already tag that way

When the view looks right, send a screenshot of the filter criteria. We translate those conditions into a VQL query on our side. You do not write VQL.

After go-live

Once the connection is active:

1. The recurring job lists documents that match the query.
2. New matches are created as presentations on your team.
3. Changed approved versions replace the file on the same presentation.
4. Withdrawn or obsolete documents deactivate in Mobile Locker.

We will import a small test set with you before we turn on the full filter. Confirm one PDF and one PowerPoint in the Mobile Locker admin library (name, product, and that slides open).

Optional custom fields

Access and the ingest filter only decide which documents Mobile Locker imports. They do not set folder, group, share, print, or label behavior in Mobile Locker.

To drive those settings from Vault, add the Mobile Locker custom document fields (ml_*__c) and have us enable them on the connection. That process is separate. See Veeva Vault custom fields for Mobile Locker.

Checklist

1. Create a dedicated read-only Vault user (password policy, not SSO).
2. Set email to support+[client]@mobilelocker.com and note the Vault user name.
3. Set password expiration to No expiration on that user's security policy.
4. Grant API access plus download of source files and renditions.
5. Put the user in a group that can view content for the ingest document types.
6. Email the Vault URL, user name, and the email you configured to support@mobilelocker.com. Do not send a password. Vault will email us so we can generate one.
7. Agree the library filter with Mobile Locker and your marketing or medical owners (this can be later).
8. Confirm a test PDF and a test PowerPoint in Mobile Locker.
9. Optional: add ml_* fields when you want Vault to set folders, groups, and labels.

Questions: contact support@mobilelocker.com or your Mobile Locker account team.