Compliance Connectors
Connector setup reference
For every connector, how it connects, what the connect form asks for, the read-only grant to create at the vendor, and the vendor's documentation.
Every one of the 672 connectors, as the connect form on Compliance › Connectors shows it. Connect with lists the methods the card is built for: OAuth appears only where Safeguard has an OAuth app for that vendor, and the API token method is always there. The form asks for is what the API token method asks for. Grant at the vendor is the vendor's own name for the read-only scope, role or permission to create, shown as the vendor writes it; where a vendor has no read-only option, the note says so. Each connector's name links to its own page, with the steps to connect it.
See Compliance connectors for how connecting works, card statuses and multiple accounts.
Identity & SSO
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| 1Password | API token | SCIM bridge URL, SCIM bridge bearer token | — | — |
| Auth0 | API token | Auth0 domain, M2M client ID, M2M client secret, Management API token (optional) | — | — |
| Auth0 SSO | API token | Auth0 domain, M2M client ID, M2M client secret, Management API token (optional) | — | — |
| Authentik | API token | Instance URL, API token | view: users, authenticator devices, validation stages | Docs |
| Beyond Identity | API token | Tenant ID, Realm ID, Access token, Region | identities:read | Docs |
| Clerk | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Cloudflare Access | API token | API token, Account ID | Access: Audit Logs Read, Access: Apps and Policies Read | Docs |
| CyberArk | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| CyberArk SSO | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Descope | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Duo Security | API token | Integration key, Secret key, Host | Grant resource - Read, Grant administrators - Read | Docs |
| Duo SSO | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Entrust | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ForgeRock | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Frontegg | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| FusionAuth | API token | Instance URL, API key, Tenant ID (optional), Application ID (optional) | GET /api/user/search, GET /api/tenant | Docs |
| Google Cloud Identity | OAuth, API token | Service account key (JSON), Admin email to impersonate, OAuth access token (optional) | — | — |
| Google SSO | OAuth, API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Google Workspace | OAuth, API token | Service account key (JSON), Admin email to impersonate, OAuth access token (optional) | — | — |
| HYPR | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| IBM Verify | API token | Instance URL, Client ID, Client secret; or, instead: Access token (optional) | readUsers, readUserGroups | Docs |
| Idaptive | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| JumpCloud | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| JumpCloud MDM | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| JumpCloud SSO | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Keycloak | API token | Keycloak base URL, Realm, Service account client ID, Client secret, Admin bearer token (optional) | — | — |
| LastPass SSO | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| LoginRadius | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Logto | API token | Instance URL, Client ID, Client secret, Tenant ID (optional) | Logto Management API: all (M2M role)Logto issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Microsoft Entra ID | OAuth, API token | Directory (tenant) ID, Application (client) ID, Client secret, Graph access token (optional) | — | — |
| Microsoft Entra SSO | OAuth, API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| miniOrange | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Okta | API token | Okta org URL, API token | — | — |
| Okta SSO | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| OneLogin | API token | Client ID, Client secret, Subdomain | Read AllOptional, broader than read-only: Manage users. Without it, the checks that need it show an error naming it. Safeguard only reads with it. | Docs |
| OneLogin SSO | API token | Client ID, Client secret, Subdomain | Read AllOptional, broader than read-only: Manage users. Without it, the checks that need it show an error naming it. Safeguard only reads with it. | Docs |
| Oracle Identity | API token | Instance URL, Client ID, Client secret | read users (confidential application) | Docs |
| Ping Identity | API token | Environment ID, Region, Worker app client ID, Worker app client secret | — | — |
| Ping SSO | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| PingOne | API token | Environment ID, Region, Worker app client ID, Worker app client secret | — | — |
| RingCentral | API token | Access token, Environment (optional) | ReadAccounts | Docs |
| Rippling Identity | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| RSA SecurID | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SailPoint | API token | Instance URL, Client ID, Client secret | idn:campaign:read, sp:search:read | Docs |
| Saviynt | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SecureAuth | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Stytch | API token, MCP server | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SuperTokens | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Teleport | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Transmit Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| WorkOS | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| WorkOS SSO | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Zitadel | API token | Instance URL, Personal access token, Organization ID (optional) | ORG_OWNER_VIEWER, IAM_OWNER_VIEWER | Docs |
Cloud Infrastructure
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Akamai | API token | Host, Client token, Client secret, Access token | IAM User Admin: READ-ONLY, Application Security: READ-ONLY, CPS: READ-ONLY, Contract API: READ-ONLY | Docs |
| Alibaba Cloud | API token | Access key ID, Access key secret, Region (optional), Regions (optional) | ReadOnlyAccess | Docs |
| Amazon Web Services | API token | AWS Access Key ID, AWS Secret Access Key, Region, Session token (optional) | — | — |
| Aptible | API token | SCIM token | SCIM tokenA SCIM token can also create and change users, and Aptible has no read-only one. Safeguard only reads with it. | Docs |
| AWS GovCloud | API token | AWS Access Key ID, AWS Secret Access Key, Region, Session token (optional) | — | — |
| Azure Government | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Civo | API token | API key, Regions (optional) | Civo issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Cloudflare | API token | API token, Account ID (optional) | Account Settings Read, Zone Read, Zone Settings Read, DNS Read, Zone WAF Read, Account API Tokens ReadOptional, read-only: Bot Management Read. The connection does not ask for it by default; without it, the checks that need it show an error naming it. | Docs |
| Cloudflare R2 | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Crossplane | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| DigitalOcean | API token | Access token | *:read | Docs |
| DigitalOcean Spaces | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Fastly | API token | API token | global:read | Docs |
| Fly.io | API token | Access token, Organization | fly tokens create readonly | Docs |
| GoDaddy | API token | API key, API secret, Environment (optional), Customer number (optional); or, instead: Personal access token | domains.domain:readRecommended: a personal access token with only domains.domain:read, created at developer.godaddy.com › Personal Access Tokens; it is read-only. Or a classic API key and secret for the same environment (production or OTE): GoDaddy is retiring those for its Domains API and they carry full account access, though Safeguard only reads with them. Add the customer number to read DNSSEC from GoDaddy; without it, Safeguard checks the public DS record. GoDaddy limits its Domains API to eligible accounts: its documentation asks for at least one domain or a plan that grants management access, and GoDaddy has restricted production access to accounts with 10 or more domains or a Discount Domain Club (Domain Pro) plan. If GoDaddy refuses the account, the tests show an error naming this restriction, never a failure. | Docs |
| Google Cloud Platform | OAuth, API token | Service account key (JSON) | — | — |
| HashiCorp Consul | API token | Base URL, API token | agent:read | Docs |
| HashiCorp Nomad | API token | Base URL, API token | agent:read | Docs |
| Heroku | API token | API key, Team (optional) | read | Docs |
| Hetzner | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| IBM Cloud | API token | API key, Account ID (optional), Regions (optional) | Viewer (platform), Reader (service) | Docs |
| Kubernetes | API token | API server URL, Service account token, Cluster CA certificate (PEM) (optional), Cluster name (optional); or, instead: Kubeconfig (optional) | get, list: clusterrolebindings, clusterroles, roles, rolebindings, namespaces, nodes, pods, serviceaccounts, networkpolicies, get, list: constraints.gatekeeper.sh, kyverno.io policies | Docs |
| Linode | API token | Access token | account:read_only, firewall:read_only, linodes:read_only | Docs |
| Microsoft Azure | OAuth, API token | Directory (tenant) ID, Application (client) ID, Client secret, Graph access token (optional) | — | — |
| Netlify | API token, MCP server | Access token, Account (optional) | Netlify issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Northflank | API token | API token, Team ID | Team > Members > Read | Docs |
| Nutanix | API token | Base URL, Username, Password | Prism Central Viewer | Docs |
| OpenStack | API token | API URL, Application credential ID, Application credential secret, Region (optional) | reader | Docs |
| Oracle Cloud | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Oracle Cloud Government | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| OVHcloud | API token | Application key, Application secret, Consumer key, Region, Access key (optional), Secret key (optional) | GET /me, GET /me/*, GET /cloud/project, GET /cloud/project/*, GET /ip, GET /ip/*Optional, broader than read-only: an S3 user with a read-only policy (s3:GetBucketAcl, s3:GetBucketPolicy). Without it, the checks that need it show an error naming it. Safeguard only reads with it. | Docs |
| Platform.sh | API token | API token, Organization ID, Environment (optional) | Platform.sh issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Portainer | API token | Base URL, Access token | administratorPortainer shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Proxmox | API token | Base URL, Token ID, Token secret | PVEAuditor on / | Docs |
| Qovery | API token | API token, Organization ID (optional) | the lowest role that reads members | Docs |
| Rackspace | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Railway | API token | API token, Workspace ID | workspace tokenRailway issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Rancher | API token | Base URL, API token | Read-only global role | Docs |
| Red Hat OpenShift | API token | API server URL, Service account token, Cluster CA certificate (PEM) (optional); or, instead: Kubeconfig (optional) | get: oauths, apiservers (config.openshift.io), get: configs (imageregistry.operator.openshift.io), get, list: securitycontextconstraints, clusterrolebindings | Docs |
| Render | API token | API key, Owner ID (optional) | Render issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Scaleway | API token | Secret key, Organization ID, Zones (optional) | IAMReadOnly, InstancesReadOnly | Docs |
| Spaceship | API token | API key, API secret | domains:read, dnsrecords:readCreate the key in Spaceship's API Manager (spaceship.com › API Manager › New API key) with only the domains:read and dnsrecords:read scopes, both read-only, then paste the key and its secret. Spaceship's API does not show DNSSEC, the account's two-factor authentication or who can sign in: Safeguard checks DNSSEC through the public DS record, and the other two are attested. | Docs |
| UpCloud | API token | Username, Password; or, instead: API token (optional) | API sub-account, read access | Docs |
| Vercel | API token, MCP server | Access token, Team ID (optional) | team-scoped tokenVercel issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| VMware | API token | Base URL, Username, Password | Read-only (SSO user) | Docs |
| VMware Carbon Black | API token | Environment, Org key, API ID, API secret | device: READ, org.alerts: READ | Docs |
| VMware Workspace ONE | API token | Host, Tenant code, Access token; or, instead: Username (optional), Password (optional) | Devices: read (read-only administrator) | Docs |
| Vultr | API token | API key | instance and firewall read ACLsOptional, broader than read-only: manage_users. Without it, the checks that need it show an error naming it. Safeguard only reads with it. | Docs |
| Yotta | Record only | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Version Control
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Assembla | API token | API key, API secret, Space (optional) | Assembla issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. The credential carries its user's rights: create it as a user who can see every account. | Docs |
| AWS CodeCommit | API token | AWS Access Key ID, AWS Secret Access Key, Region, Session token (optional) | — | — |
| Azure DevOps | OAuth, API token | Directory (tenant) ID, Application (client) ID, Client secret, Graph access token (optional) | — | — |
| Beanstalk | API token | Account, Username, Access token | Beanstalk shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Beanstalk issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Bitbucket | OAuth, API token | Bitbucket username, App password, Workspace | — | — |
| Codeberg | API token | Organization, Access token | read:organization, read:repository, read:userCodeberg shows some settings only to owners, so create the token as an owner. Safeguard only reads with it. | Docs |
| Gerrit | API token | Instance URL, Username, HTTP password | Read on projects and refs/meta/config, View All Accounts | Docs |
| Gitea | API token | Instance URL, Access token, Organization | read:organization, read:repository, read:userGitea shows some settings only to owners, so create the token as an owner. Safeguard only reads with it. | Docs |
| GitHub | OAuth, API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GitHub Dependabot | OAuth, API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GitHub Enterprise | OAuth, API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GitHub Issues | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GitKraken | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GitLab | API token | Base URL (self-hosted), API token / PAT | — | — |
| GitLab Issues | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GitLab Self-Managed | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Launchpad | API token | Team, Consumer key (optional), OAuth token (optional), OAuth token secret (optional) | READ_PRIVATE (private teams only) | Docs |
| Perforce | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SourceForge | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Vulnerability Scanning
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Acunetix | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Aikido Security | API token | Client ID, Client secret, Region; or, instead: Access token (optional) | issues:read, repositories:read | Docs |
| Anchore | API token | API URL, API key, Account (optional); or, instead: Username (optional), Password (optional) | read-only role | Docs |
| Apiiro | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Arnica | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| AWS Inspector | API token | AWS Access Key ID, AWS Secret Access Key, Region, Session token (optional) | — | — |
| Bright Security | API token | API key | projects:read, scans:read | Docs |
| Bugcrowd | API token | API token | view the programs' submissionsIf Bugcrowd restricts API access by IP address, allow Safeguard's outbound address. | Docs |
| Burp Suite | API token | Server URL, API key | view sites, scans and issues | Docs |
| Chainguard | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Checkmarx | API token | Refresh token, Tenant, Region | view-projects, view-scans, view-results | Docs |
| Cobalt | API token | API token, Organization token (optional), Region (optional) | organization member | Docs |
| Contrast Security | API token | API key, Username, Service key, Organization ID, Base URL (optional) | View | Docs |
| Dependency-Track | API token | API URL, API key | VIEW_PORTFOLIO, VIEW_VULNERABILITY | Docs |
| Detectify | API token | API key | vulnerabilities: read | Docs |
| Edgescan | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Endor Labs | API token | API key, API secret, Namespace, Region | Read-Only | Docs |
| Escape | API token | API key | read | Docs |
| GitGuardian | API token | API token, Region (optional), Base URL (optional) | incidents:read, sources:read | Docs |
| Grype | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| HackerOne | API token | API identifier, API token, Program handle (optional) | Report viewer | Docs |
| Intruder | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Invicti | API token | User ID, API token, Base URL (optional) | read-only role | Docs |
| JFrog Xray | API token | Instance URL, Access token | Read on the watched resources | Docs |
| Legit Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Mend | API token | Email, User key, Organization ID, Base URL (optional) | Auditor (service user) | Docs |
| Nessus | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Nuclei | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Nucleus Security | API token | Instance URL, API key, Project ID (optional) | read-only access to the projects | Docs |
| OpenVAS | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| OWASP ZAP | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Ox Security | API token | API key, Base URL (optional) | read-only API key role | Docs |
| Phylum | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Probely | API token | API key | read-only role | Docs |
| Qualys | API token | Username, Password, Platform | API access, Reader | Docs |
| Qualys EDR | API token | API URL, Username, Password | Reader (EDR) | Docs |
| Rapid7 InsightVM | API token | API key, Region | InsightVM read-only | Docs |
| Red Hat Advanced Cluster Security | API token | Instance URL, API token | Analyst (system role) | Docs |
| Safeguard | API token, MCP server | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Semgrep | API token | API token | Web APISafeguard's compliance tests for Semgrep need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Snyk | API token | API token, Organization ID (optional), Region | — | — |
| Socket | API token | API token, Organization (optional) | alerts:list | Docs |
| SonarQube | API token | Base URL (optional), API token, Organization (optional) | Browse | Docs |
| StackHawk | API token | API key, Organization ID (optional) | Member | Docs |
| StackRox | API token | Instance URL, API token | Analyst (system role) | Docs |
| Tenable | API token | Access key, Secret key, Environment (optional) | Basic (vulnerability export), Administrator or a custom Export role (asset export) | Docs |
| Tenable Cloud Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Trivy | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| TruffleHog | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Veracode | API token | API ID, API key, Region | Results API | Docs |
| Wallarm | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
HRIS
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| 15Five | API token | API key | 15Five shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| ADP Workforce Now | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Ashby | API token | API key | organizationRead | Docs |
| BambooHR | API token | Company subdomain, API key | workEmail, hireDate, supervisorEId, employmentHistoryStatusThe credential carries its user's rights: create it as a user who can see every account. | Docs |
| Bob | API token | Service user ID, Service user token | View: Root, Work, Internal, Payroll (Employment) | Docs |
| Ceridian Dayforce | API token | Host, Client namespace, Username, Password; or, instead: Access token (optional) | read employee status, contacts and managers | Docs |
| Charlie HR | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Culture Amp | API token | SCIM base URL, SCIM token | SCIM token | Docs |
| Deel | API token | Organization API token | people:read | Docs |
| Employment Hero | API token | Access token, Organization ID | employees read | Docs |
| Factorial | API token | API key; or, instead: Access token (optional) | employees: read | Docs |
| Greenhouse | API token | Access token | harvest:users:list | Docs |
| Gusto | API token | Access token, Company ID, Environment (optional) | employees:read, contractors:read, company_admin:readSafeguard's compliance tests for Gusto need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| HiBob | API token | Service user ID, Service user token | View: Root, Work, Internal, Payroll (Employment) | Docs |
| Hourly | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Humaans | API token | Access token | people: read, job roles: read | Docs |
| Insperity | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Justworks | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Lattice | API token | API key | users: read | Docs |
| Lever | API token | API key; or, instead: Access token (optional) | users:read:admin | Docs |
| Multiplier | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Namely | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Oyster HR | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Papaya Global | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Paychex | API token | Company ID, Client ID, Client secret; or, instead: Access token (optional) | workers: read, communications: read | Docs |
| Paycom | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Paylocity | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Personio | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Remote | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Rippling | API token | API token | workers:read, users:read, employment_types:read | Docs |
| Rippling MDM | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sage HR | API token | Subdomain, API key | Sage HR shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| SAP SuccessFactors | API token | Host, Username, Password, Company ID; or, instead: Access token (optional) | User, EmpEmployment, EmpJob | Docs |
| Sapling | API token | Subdomain, API key | profiles: read | Docs |
| TriNet | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| UKG | API token | Host, Username, Password, Customer API key | Employee Employment Information: View, Person Details: View | Docs |
| Workable | API token | Subdomain, Access token | r_jobs | Docs |
| Workday | API token | Report URL, Username, Password; or, instead: Client ID, Client secret, Refresh token | Integration System User, Get_Workers (custom report, web service enabled) | Docs |
| Workleap | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Zenefits | API token | Access token | people:read, employments:read | Docs |
Endpoint Detection & Response
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Arctic Wolf | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Arctic Wolf Managed Awareness | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Bitdefender GravityZone | API token | API URL, API key | Network API, Incidents API | Docs |
| Blackpoint Cyber | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Check Point Harmony | API token | Region, Client ID, Access key | Endpoint: Read-only | Docs |
| Cisco Secure Endpoint | API token | Region, Client ID, API key | Read-only | Docs |
| Cortex XDR | API token | API URL, API key, API key ID, Key type (optional) | Viewer | Docs |
| CrowdStrike Falcon | API token | Client ID, Client secret, Cloud, Member CID (optional) | Hosts: Read, Prevention policies: Read, Alerts: Read, Vulnerabilities: Read, User management: Read | Docs |
| CrowdStrike Falcon Cloud | API token | Client ID, Client secret, Cloud | CSPM registration: Read | Docs |
| Cybereason | API token | Host, Username, Password | read-only analyst | Docs |
| Cynet | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Deep Instinct | API token | Base URL, API key | read-only API connector | Docs |
| Elastic Security | API token | Instance URL, API key, Space ID (optional) | Fleet: Read, Integrations: Read, Security: Read | Docs |
| ESET Protect | API token | Region, Username, Password | read-only permission set | Docs |
| Fleet osquery | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Fortinet FortiEDR | API token | Host, Username, Password, Organization (optional) | REST API, read-only | Docs |
| Huntress | API token | API key, API secret | — | Docs |
| Jamf Protect | API token | Tenant, Client ID, Password | read-only role | Docs |
| Kaspersky Endpoint | API token | Server URL, Username, Password | Auditor | Docs |
| Lookout | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Malwarebytes | API token | Client ID, Client secret, Account ID, Region | read | Docs |
| Microsoft Defender for Endpoint | API token | Tenant ID, Client ID, Client secret | Machine.Read.All, Alert.Read.All, Vulnerability.Read.All | Docs |
| Rapid7 InsightIDR | API token | Region, User key | Read Only user | Docs |
| Red Canary | API token | Subdomain, API key | read access | Docs |
| SentinelOne | API token | Subdomain, API token | Viewer | Docs |
| Sophos Intercept X | API token | Client ID, Client secret | Service Principal Read-only | Docs |
| Symantec Endpoint | API token | Client ID, Client secret, Region; or, instead: OAuth token (optional) | View | Docs |
| Tanium | API token | Host, API token | Read Only User, Threat Response Read Only | Docs |
| Trellix | API token | Server URL, Username, Password | System Tree: View, Threat Event Log: View | Docs |
| Trend Micro Apex One | API token | Region, API key | Endpoint Inventory: View, Workbench: View | Docs |
| Webroot | API token | GSM key, Site ID, Client ID, Client secret, Username, Password | View-only site access, Console.GSMWebroot has no narrower grant for these reads. Safeguard only reads with it. | Docs |
| WithSecure | API token | Client ID, Client secret, Organization ID (optional) | connect.api.read | Docs |
MDM
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| 42Gears | API token | Instance URL, API key, Username, Password | role template with no actions | Docs |
| Action1 | API token | Client ID, Client secret, Region, Organization ID (optional) | view_endpoints | Docs |
| Addigy | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Automox | API token | API key, Organization ID | read-only administrator | Docs |
| Baramundi | API token | Server URL, Username, Password | read-only role on endpoints and AD users | Docs |
| Cisco Meraki SM | API token | API key, Network ID | sm:config:read | Docs |
| Citrix Endpoint Management | API token | Server URL, Auth token; or, instead: Citrix Cloud token (optional) | PUBLIC_API_ACCESS (view devices) | Docs |
| Esper | API token | Tenant, API key | Viewer | Docs |
| Fleet | API token | Server URL, API token | API-only user, Observer | Docs |
| Hexnode | API token | Subdomain, API key | API access enabled | Docs |
| IBM MaaS360 | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Ivanti Neurons | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Jamf | API token | Subdomain, Client ID, Client secret; or, instead: API token (optional) | Read Computers, Read Mobile Devices, Read macOS Configuration Profiles | Docs |
| Kandji | API token | Subdomain, API token, Region (optional) | Device list, Device details, Device status | Docs |
| Kolide | API token | API key | read-only (no write permissions ticked) | Docs |
| ManageEngine | API token | Access token, Data center | DesktopCentralCloud.Common.READ, DesktopCentralCloud.DataEncryption.READ | Docs |
| Microsoft Intune | API token | Tenant ID, Client ID, Client secret | DeviceManagementManagedDevices.Read.All, DeviceManagementConfiguration.Read.All | Docs |
| Miradore | API token | Site, API key | Miradore has no narrower grant for these reads. Safeguard only reads with it. | Docs |
| Mosyle | API token | Access token, Email, Password | Devices: View, Users: View, API Integration: View, CreateMosyle's API signs in with an admin's email and password as well as the access token. Create a dedicated admin for Safeguard whose role can only view devices and users, with its own Mosyle password (an admin who signs in only through SSO cannot use the API). Signed in as that admin, create the token under Organization › Integrations › Mosyle API Integration, with Public access or Safeguard's address allowed. Enter all three here yourself: Safeguard stores them encrypted and sends the password only to Mosyle's sign-in. Mosyle's API reference is not public, so Safeguard reads only the fields public integrations confirm. FileVault, the firewall and a Mac's screen lock show a "couldn't read" error, never a pass or a fail, until the first live connection confirms where Mosyle reports them; attest them meanwhile. Until Mosyle's tests are switched on for your workspace, device posture stays an attestation. Safeguard's compliance tests for Mosyle need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| NinjaOne | API token | Client ID, Client secret, Region; or, instead: Access token (optional) | monitoring | Docs |
| Prey | API token | API key | Prey has no narrower grant for these reads. Safeguard only reads with it. | Docs |
| Scalefusion | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SimpleMDM | API token | API key | Devices: Read | Docs |
| SOTI MobiControl | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Ticketing
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Aha! | API token | Subdomain, API key | Aha! shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Airtable | API token, MCP server | Account ID, Access token | enterprise.account:read, enterprise.user:readNeeds Airtable's Enterprise Scale plan. Safeguard's compliance tests for Airtable need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Asana | API token, MCP server | Access token, Workspace ID (optional) | workspace_memberships:read, users:read, tasks:read, tags:read | Docs |
| Azure Boards | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Basecamp | API token | Account ID, Access token | Basecamp shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| ClickUp | API token | API token, Team ID (optional) | owner or admin token (to see roles) | Docs |
| Freshdesk | API token | Domain, API key | Account AdministratorFreshdesk shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Freshservice | API token | Domain, API key; or, instead: Access token (optional) | freshservice.tickets.view | Docs |
| Hive | API token | Workspace ID, API key | — | Docs |
| Intercom Tickets | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Jira | OAuth, API token | Atlassian account email, API token, Site URL | — | — |
| Jira Service Management | API token | Atlassian account email, API token, Site URL | read:servicedesk-request, read:jira-work | Docs |
| Linear | API token, MCP server | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Monday.com | API token, MCP server | API token, Board IDs | boards:read, users:readSafeguard's compliance tests for Monday.com need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Opsgenie Alerts | API token | API key, Region | Read, Configuration access | Docs |
| PagerDuty | API token, MCP server | API key, Region (optional) | services.read, escalation_policies.read, schedules.read, users.read, incidents.read | Docs |
| PagerDuty Incidents | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Productboard | API token | Access token | members:read, members:pii:read | Docs |
| Redmine | API token | Instance URL, API key | View issues | Docs |
| ServiceNow | API token | Instance URL, Username, Password; or, instead: Access token (optional) | read: incident, problem, sc_req_item, change_request, sys_user, sys_user_has_role | Docs |
| Shortcut | API token | API token | — | Docs |
| Smartsheet | API token | Access token, Region (optional) | READ_USERS, System AdminSmartsheet shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| SolarWinds Service Desk | API token | Region, API token | view incidents, audits and users | Docs |
| Teamwork | API token | Site, API key; or, instead: Access token (optional) | site administratorTeamwork shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Safeguard's compliance tests for Teamwork need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Trello | API token | Enterprise ID, API key, API token | read:enterprise:trelloNeeds Trello's Enterprise plan. Trello shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Safeguard's compliance tests for Trello need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Wrike | API token | Access token, Host (optional), Account ID (optional) | wsReadOnly, amReadOnlyUser | Docs |
| YouTrack | API token | Instance URL, Permanent token | Read Issue, Read User (Hub) | Docs |
| Zendesk | API token | Subdomain, Email, API token; or, instead: Access token (optional) | users:readZendesk shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Safeguard's compliance tests for Zendesk need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Zendesk Sell | API token | Access token | readThe credential carries its user's rights: create it as a user who can see every account. | Docs |
| Zoho Desk | API token | Organization ID, Access token, Data center (optional) | Desk.basic.READSafeguard's compliance tests for Zoho Desk need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
Observability
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Amazon CloudWatch | API token | AWS Access Key ID, AWS Secret Access Key, Region, Session token (optional) | — | — |
| AppDynamics | API token | Instance URL, Client ID, Client secret | read-only role | Docs |
| Better Stack | API token | API token, Telemetry token (optional) | Better Stack issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Bugsnag | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Checkmk | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Chronosphere | API token | Instance URL, API token | read-only service account | Docs |
| Coralogix | API token | Domain, API key | alerts:ReadConfig, team-members:ReadConfig | Docs |
| Cronitor | API token | API key | monitors and notification lists: read | Docs |
| Datadog | API token | API Key, Application Key, Site | monitors_read, synthetics_read, logs_read_config, logs_read_archives, user_access_read, security_monitoring_signals_read, security_monitoring_findings_read | Docs |
| Datadog CSM | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Dynatrace | API token | Instance URL, API token, Account ID (optional), Client ID (optional), Client secret (optional) | settings.read, account-idm-read | Docs |
| Elastic Observability | API token | API key (optional), Instance URL (optional); or, instead: API key (optional), Instance URL (optional) | Cloud Viewer, monitor, read_ilm, view_index_metadata (logs-*), Stack rules: Read | Docs |
| Google Cloud Operations | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Grafana | API token | API token, Instance URL | org.users:read, alert.provisioning:read, serviceaccounts:read | Docs |
| Honeycomb | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Instana | API token | Instance URL, API token | alert configurations and users: read | Docs |
| LogicMonitor | API token | Account, Bearer token | view-only API user | Docs |
| Logz.io | API token | Region, API token | Logz.io issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Nagios | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Netdata | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| New Relic | API token | User key, Account ID, Region | read-only: user management, alerts, data management | Docs |
| OpenTelemetry | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Pingdom | API token | API token | read-only | Docs |
| Prometheus | API token | Server URL, Alertmanager URL (optional), Bearer token (optional), Username (optional), Password (optional) | read access through your proxy | Docs |
| Raygun | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Rollbar | API token | Access token | read | Docs |
| Sentry | API token, MCP server | Auth token, Organization, Region (optional) | org:read, project:read, alerts:read, member:readSafeguard's compliance tests for Sentry need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| SigNoz | API token | Base URL, API key | SigNoz-Viewer, SigNoz-Admin (optional elevated grant, for the account tests)A service account key with SigNoz-Viewer verifies the connection and runs the alert and log-retention tests. The account tests (accounts linked to people, leavers, admin count) list users and roles, which only the SigNoz-Admin role can do: custom roles cannot grant user management. SigNoz-Admin also grants write, so give it as an elevated grant, or keep the key as Viewer and attest those tests. | Docs |
| Site24x7 | API token | Data center, Access token | Site24x7.Admin.Read, Site24x7.Account.Read | Docs |
| Splunk | API token | API token, Instance ID, Environment (optional) | sc_admin, list_users, search-head API access (port 8089)If Splunk restricts API access by IP address, allow Safeguard's outbound address. | Docs |
| Splunk SOAR | API token | Base URL, Auth token | automation user, read on containers | Docs |
| Sumo Logic | API token | Access ID, Access key, Region | View Users and Roles, View Partitions, View Monitors | Docs |
| Uptime Robot | API token | API key | read-only API key | Docs |
| VictoriaMetrics | API token | Server URL, Alertmanager URL (optional), Bearer token (optional), Username (optional), Password (optional) | read access through your proxy | Docs |
| Zabbix | API token | Server URL, API token | action.get, user.getZabbix has no narrower grant for these reads. Safeguard only reads with it. | Docs |
Cloud Storage Provider
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Amazon S3 | API token | AWS Access Key ID, AWS Secret Access Key, Region, Session token (optional) | — | — |
| Azure Blob Storage | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Backblaze | API token | Key ID, Application key | listBuckets, readBucketEncryption, readBucketRetentions | Docs |
| Box | API token, MCP server | Access token | manage_managed_users, App + Enterprise accessBox has no narrower grant for these reads. Safeguard only reads with it. | Docs |
| Citrix ShareFile | API token | Subdomain, Access token, Region (optional) | AdminManageEmployeesCitrix ShareFile shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Dropbox | API token | Access token | members.read | Docs |
| Dropbox Sign | API token | API key; or, instead: Access token (optional) | team_accessDropbox Sign shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Egnyte | API token, MCP server | Domain, Access token | Egnyte.userEgnyte shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Safeguard's compliance tests for Egnyte need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Google Cloud Storage | OAuth, API token | Service account key (JSON) | — | — |
| Google Drive | OAuth, API token, MCP server | Service account key (JSON), Admin email to impersonate, OAuth access token (optional) | drive.readonly | Docs |
| Hack The Box | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| iCloud | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| IDrive | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| MinIO | API token | Server URL, Access key, Secret key | s3:ListAllMyBuckets, s3:GetBucket* | Docs |
| Nextcloud | API token | Base URL, Username, App password | Nextcloud shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| OneDrive | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ownCloud | API token | Base URL, Username, App password | ownCloud shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| pCloud | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SharePoint | API token | Tenant ID, Client ID, Client secret, Cloud (optional) | SharePointTenantSettings.Read.All, Global Reader or SharePoint Administrator (signed-in user) | Docs |
| Storj | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Wasabi | API token | Access key, Secret key | s3:ListAllMyBuckets, s3:GetBucket* | Docs |
Compliance As Code
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Anecdotes | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Apptega | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Archer | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| AuditBoard | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Confluence | API token | Email, API token, Site URL, Organization ID (optional), Organization admin API key (optional) | Organization admin API key, read:jira-workSafeguard's compliance tests for Confluence need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Drata | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| First Advantage | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Google Docs | OAuth, API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Hyperproof | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| LogicGate | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| MetricStream | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| NAVEX PolicyTech | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Notion | API token, MCP server | Access token | Read user information including email addresses | Docs |
| PowerDMS | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Scrut Automation | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Secureframe | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sprinto | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Strike Graph | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Thoropass | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| TrustCloud | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Tugboat Logic | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Vanta | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Vendor Procurement
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Airbase | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| BitSight | API token | API token, Company ID (optional) | view the company's own rating | Docs |
| Brex | API token | Access token | users.readonly | Docs |
| Conveyor | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Coupa | API token | Instance URL, Access token; or, instead: Client ID (optional), Client secret (optional) | core.user.read | Docs |
| CyberGRX | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Gatekeeper | API token | API server URL, Service account token, Cluster CA certificate (PEM) (optional), Cluster name (optional); or, instead: Kubeconfig (optional) | get, list: clusterrolebindings, clusterroles, roles, rolebindings, namespaces, nodes, pods, serviceaccounts, networkpolicies, get, list: constraints.gatekeeper.sh, kyverno.io policies | Docs |
| Gatekeeper OPA | API token | API server URL, Service account token, Cluster CA certificate (PEM) (optional), Cluster name (optional); or, instead: Kubeconfig (optional) | get, list: clusterrolebindings, clusterroles, roles, rolebindings, namespaces, nodes, pods, serviceaccounts, networkpolicies, get, list: constraints.gatekeeper.sh, kyverno.io policies | Docs |
| HyperComply | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Loopio | API token | Access token, Region (optional); or, instead: Client ID (optional), Client secret (optional) | user:read, role:read | Docs |
| OneTrust Questionnaire | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| OneTrust Vendorpedia | API token | Host, Access token; or, instead: Client ID (optional), Client secret (optional) | SCIMA SCIM token can also create and change users, and OneTrust Vendorpedia has no read-only one. Safeguard only reads with it. | Docs |
| Order.co | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Panorays | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Precoro | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Prevalent | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ProcessUnity | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Ramp | API token, MCP server | Access token; or, instead: Client ID (optional), Client secret (optional) | users:read | Docs |
| Responsive | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| RiskRecon | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SafeBase | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SAP Ariba | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sastrify | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SecurityScorecard Atlas | API token | API token, Domain | read the company's own scorecard | Docs |
| Setyl | API token | API key, Consumer ID | company-wide API key (an Owner creates it) | Docs |
| Spendflo | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Tropic | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| UpGuard Vendor Risk | API token | API key | BreachRisk | Docs |
| Vendict | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Vendr | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Venminder | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Whistic | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Zip | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
User Access Review
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| BetterCloud | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ConductorOne | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Josys | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Lumos | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Omada Identity | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Opal | API token | API token | read-only token | Docs |
| Rezonate | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sonrai Access | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Torii | API token | API key | — | Docs |
| Trelica | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Veza | API token | Instance URL, API key | view access reviews | Docs |
| Zilla Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Zluri | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Security Training
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| 360Learning | API token | Client ID, Client secret, Region | users:read, paths:read, pathStats:read | Docs |
| Cornerstone | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Coursera | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Curricula | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| CybSafe | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Docebo | API token | Subdomain, Access token | api, users and enrollments: read | Docs |
| Hoxhunt | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Immersive Labs | API token | Access key, Secret key | organisation activity: read | Docs |
| Infosec IQ | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| KnowBe4 | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Lessonly | API token | Subdomain, API key | — | Docs |
| Living Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Mimecast Awareness | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| NINJIO | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Pluralsight | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Proofpoint Security Awareness | API token | API key, Region | Results API: Training, Results API: Phishing | Docs |
| Riot | API token | API key, Workspace ID (optional) | courses, campaigns and attacks: read | Docs |
| SANS Security Awareness | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Secure Code Warrior | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| TalentLMS | API token | Domain, API key | — | Docs |
| Terranova Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| TryHackMe | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Udemy Business | API token | Organization, Organization ID, Client ID, Client secret | Reporting API | Docs |
| Wizer | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Background Check Providers
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Accurate | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Certn | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Checkr | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Cisive | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ClearChecks | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GoodHire | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| HireRight | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| IDenfy | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Jumio | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Onfido | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Persona | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Socure | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sterling | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Truework | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Universal Background Screening | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Veremark | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Vetty | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Yardstik | API token | API key | reports and candidates: read | Docs |
| Zinc | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
CSPM
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Aqua Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| AWS Security Hub | API token | AWS Access Key ID, AWS Secret Access Key, Region, Session token (optional) | — | — |
| Check Point CloudGuard | API token | API key ID, API key secret, Region | read-only role | Docs |
| Cloudanix | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| CoreStack | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Cyscale | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Ermetic | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Google Security Command Center | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Kion | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Lacework | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Microsoft Defender for Cloud | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Orca Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Prisma Cloud | API token | Access key, Secret key, API URL | Account Group Read Only | Docs |
| Rapid7 InsightCloudSec | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sonrai Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Stream Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sweet Security | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sysdig | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Trend Micro Cloud One | API token | API key, Region | Read Only | Docs |
| Turbot | API token | Instance URL, Access key, Secret key | Turbot/ReadOnly | Docs |
| Uptycs | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Wiz | API token | Client ID, Client secret, Data center, Environment (optional) | read:vulnerabilities | Docs |
| Zscaler Posture Control | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Security Automation
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Blink Ops | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Cortex XSOAR | API token | Base URL, API key, API key ID (optional) | read-only role | Docs |
| Cyware | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| D3 Security | API token | API URL, Header name, Header value, Username, Site | the command's webhook key | Docs |
| Google Chronicle SOAR | API token | Project ID, Location, Instance ID, Service account key (JSON); or, instead: Access token (optional) | roles/chronicle.viewer | Docs |
| IBM QRadar SOAR | API token | Base URL, Organization ID, API key ID, API key secret | read on incidents | Docs |
| Make | API token | Organization ID, API token, Zone | user:read, organizations:read | Docs |
| Mindflow | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| n8n | API token | Instance URL, API key | user:listn8n shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Palo Alto XSOAR | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Pipedream | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Rapid7 InsightConnect | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Shuffle | API token | API key, Base URL (optional) | organization adminShuffle shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Swimlane | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ThreatConnect | API token | Base URL, Access ID, Secret key; or, instead: API token (optional) | — | Docs |
| Tines | API token | Instance URL, API key | tenant adminTines shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Torq | API token | Client ID, Client secret, Region | read on cases | Docs |
| Tray.io | API token | Access token, Region (optional) | organization adminTray.io shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Workato | API token | API token, Data center | Get collaborators | Docs |
| Zapier | API token, MCP server | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Infrastructure
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Ansible | API token | Server URL, Access token, API path (optional) | System Auditor, read scope | Docs |
| Bridgecrew | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Checkov | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Cloud Custodian | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| CloudQuery | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Conftest | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Docker | API token | Organization, Docker ID, Personal access token | — | — |
| env0 | API token | Organization ID, API key ID, API key secret | Organization Adminenv0 shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Fairwinds Polaris | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Firebase | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | firebase.readonly | Docs |
| HashiCorp Terraform | API token | Organization or team API token, Organization name, HCP Terraform host | — | — |
| HashiCorp Vault | API token | Server URL, API token, Namespace (optional) | read + sudo: sys/audit, read: sys/auth, read + list: identity/mfa/login-enforcementHashiCorp Vault has no narrower grant for these reads. Safeguard only reads with it. | Docs |
| Infisical | API token | Client ID, Client secret, Organization ID, Instance URL (optional) | Machine identity (Universal Auth), Organization: Member read, Organization: Identity read, Organization: Audit Logs read, Project: Secret Rotation read (no secret access)Needs Infisical's Pro (audit logs) plan. | Docs |
| Kyverno | API token | API server URL, Service account token, Cluster CA certificate (PEM) (optional), Cluster name (optional); or, instead: Kubeconfig (optional) | get, list: clusterrolebindings, clusterroles, roles, rolebindings, namespaces, nodes, pods, serviceaccounts, networkpolicies, get, list: constraints.gatekeeper.sh, kyverno.io policies | Docs |
| MongoDB Atlas | API token | Public key, Private key (PEM), Organization ID (optional), Environment (optional); or, instead: Client ID (optional), Client secret (optional) | Organization Read Only, Project Read Only | Docs |
| Open Policy Agent | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| PlanetScale | API token | Organization, Service token ID, Service token; or, instead: Access token (optional) | read_organization, read_database, read_branch, read_backupsSafeguard's compliance tests for PlanetScale need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Prowler | API token | API key, Base URL (optional) | read findings | Docs |
| Pulumi | API token | Organization, Access token | organization adminPulumi shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Needs Pulumi's Business Critical (policy groups) plan. | Docs |
| Pulumi Cloud | API token | Organization, Access token | organization adminPulumi Cloud shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Needs Pulumi Cloud's Business Critical (policy groups) plan. | Docs |
| Redis Cloud | API token | Account key, User key | Viewer | Docs |
| Regula | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Sentinel | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Spacelift | API token | Instance URL, API key ID, API key secret; or, instead: Access token (optional) | Read on the root space | Docs |
| Steampipe | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Supabase | API token, MCP server | Access token | organizations:read, projects:read, database:read | Docs |
| Terraform Cloud | API token | Organization or team API token, Organization name, HCP Terraform host | — | — |
| Terrascan | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| tfsec | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Digital Signature
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Adobe Acrobat Sign | API token | Access token, API URL | user_read:accountSafeguard's compliance tests for Adobe Acrobat Sign need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| BoldSign | API token | API key, Region (optional); or, instead: Access token (optional) | BoldSign shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. BoldSign issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Concord | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Contractbook | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ContractSafe | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Documenso | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| DocuSign | API token | Access token, Organization ID, Account ID, Environment (optional) | user_read, organization_readSafeguard's compliance tests for DocuSign need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| DocuSign CLM | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Eversign | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Evisort | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Foxit eSign | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GetAccept | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Ironclad | API token | Access token, Environment (optional) | scim.users.readUsers | Docs |
| Juro | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Lexion | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| LinkSquares | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Oneflow | API token | SCIM token | SCIM API tokenA SCIM token can also create and change users, and Oneflow has no read-only one. Safeguard only reads with it. | Docs |
| OneSpan Sign | API token | API key, Instance URL | account manager | Docs |
| PandaDoc | API token | API key; or, instead: Access token (optional) | read | Docs |
| PandaDoc NDA | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| RightSignature | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Signable | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Signeasy | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SignNow | API token | Access token, Organization ID | organization adminSignNow shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| SignRequest | API token | API token, Subdomain | team API tokenSignRequest issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| SignWell | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Skribble | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| SpotDraft | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Yousign | API token | API key, Environment (optional) | Yousign issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Zoho Sign | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Communications Platforms
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| 8x8 | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Aircall | API token | API ID, API token; or, instead: Access token (optional) | Aircall issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Dialpad | API token | API key, Environment (optional) | company adminDialpad shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Discord | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Front | API token | API token; or, instead: Access token (optional) | teammates:read | Docs |
| Google Meet | OAuth, API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GoTo Connect | API token | Access token, Account ID | identity:, admin user | Docs |
| Intercom | API token, MCP server | Access token, Region (optional) | Read admins | Docs |
| Mailgun | API token | API key, Region (optional) | list users | Docs |
| Mattermost | API token | Server URL, Access token | system admin or system read-only admin | Docs |
| MessageBird | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Microsoft Teams | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Miro | API token | Organization ID, Access token | — | — |
| Nextiva | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| OpenPhone | API token | API key | OpenPhone issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Plivo | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Postmark | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Rocket.Chat | API token | Server URL, User ID, Auth token | view-full-other-user-info | Docs |
| SendGrid | API token | API key | teammates.read | Docs |
| Slack | OAuth, API token, MCP server | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | users:read, users:read.email | Docs |
| Telnyx | API token | API key | owner or adminTelnyx shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. Telnyx issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. | Docs |
| Twilio | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Vonage | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Webex | API token | Access token | spark-admin:people_read, spark-admin:roles_read | Docs |
| Zoom | API token | Account ID, Client ID, Client secret; or, instead: Access token (optional) | user:read:list_users:admin, role:read:list_roles:admin, role:read:role:admin, account:read:settings:adminSafeguard's compliance tests for Zoom need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
Data Export
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Airbyte | API token | Organization ID, Client ID, Client secret; or, instead: Access token (optional) | Organization AdminAirbyte shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Amazon Redshift | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Amplitude | API token | SCIM token, Region (optional) | SCIM keyA SCIM token can also create and change users, and Amplitude has no read-only one. Safeguard only reads with it. Needs Amplitude's Enterprise plan. | Docs |
| Census | API token | Workspace ID, Access token | organization API token | Docs |
| ClickHouse | API token | Key ID, Key secret | control-plane:organization:view | Docs |
| Databricks | API token | Instance URL, Access token | service principal (not a workspace admin) | Docs |
| dbt Cloud | API token | Account ID, Service token, API URL (optional) | Account Viewer | Docs |
| Fivetran | API token | API key, API secret | Account AdministratorFivetran shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Google BigQuery | OAuth, API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Hevo Data | API token | Access key, Secret key, Region | — | Docs |
| Hightouch | API token | SCIM token | SCIM tokenA SCIM token can also create and change users, and Hightouch has no read-only one. Safeguard only reads with it. Needs Hightouch's Business plan. | Docs |
| Looker | API token | Instance URL, Client ID, Client secret | see_usersSafeguard's compliance tests for Looker need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Matillion | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Mixpanel | API token | SCIM token, Region (optional) | SCIM tokenA SCIM token can also create and change users, and Mixpanel has no read-only one. Safeguard only reads with it. Needs Mixpanel's Enterprise plan. | Docs |
| RudderStack | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Segment | API token | Access token, Region (optional) | Workspace OwnerSegment shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Snowflake | API token | Account, User, Private key (PEM), Private key passphrase (optional), Role, Warehouse; or, instead: OAuth token (optional) | IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE, USAGE on the warehouse | Docs |
| Stitch | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
CRM
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| ActiveCampaign | API token | API URL, API key | ActiveCampaign shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. The credential carries its user's rights: create it as a user who can see every account. | Docs |
| Affinity | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Attio | API token, MCP server | Access token | user_management:read | Docs |
| Capsule | API token | Access token | — | Docs |
| Close | API token, MCP server | API key, Organization ID (optional); or, instead: Access token (optional) | Admin | Docs |
| Copper | API token | API key, Email; or, instead: Access token (optional) | — | Docs |
| folk | API token | API key | — | Docs |
| Freshsales | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| GoHighLevel | API token | Private integration token, Company ID (optional); or, instead: Location ID (optional) | users.readonly | Docs |
| HubSpot | API token, MCP server | Access token | settings.users.read | Docs |
| Insightly | API token | API key, Pod (optional) | Insightly shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Keap | API token | API key; or, instead: Access token (optional) | Keap has no narrower grant for these reads. Safeguard only reads with it. | Docs |
| Microsoft Dynamics 365 | API token | Instance URL, Access token | prvReadUser, prvReadRoleSafeguard's compliance tests for Microsoft Dynamics 365 need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Nutshell | API token | Email, API key | — | Docs |
| Pipedrive | API token | API token; or, instead: Access token (optional), API URL (optional) | users:read | Docs |
| Salesflare | API token | API key | — | Docs |
| Salesforce | API token | Instance URL, Access token | api, View Setup and ConfigurationNeeds Salesforce's Enterprise (or API enabled) plan. Optional, broader than read-only: Manage Multi-Factor Authentication in API. Without it, the checks that need it show an error naming it. Safeguard only reads with it. | Docs |
| Streak | API token | API key | The credential carries its user's rights: create it as a user who can see every account. | Docs |
| SugarCRM | API token | Instance URL, Access token, Client ID (optional), Client secret (optional); or, instead: Username (optional), Password (optional) | Users: Read | Docs |
| Vtiger | API token | Instance URL, Username, Access key | Vtiger shows the full user list only to administrators, so this credential must belong to one. Safeguard only reads with it. | Docs |
| Zoho CRM | API token | Access token, API URL | ZohoCRM.users.READ | Docs |
Cyber Insurance
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| AIG | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Aon | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| At-Bay | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| AXA XL | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Beazley | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Chubb | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Coalition | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Corvus Insurance | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Cowbell Cyber | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Embroker | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Hiscox | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Marsh | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Munich Re | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Resilience | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Travelers | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Vouch | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Woodruff Sawyer | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Zurich | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Business Applications
| Connector | Connect with | The form asks for | Grant at the vendor | Vendor docs |
|---|---|---|---|---|
| Apollo IO | API token, MCP server | API key | master API keySafeguard's compliance tests for Apollo IO need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Canva | API token, MCP server | SCIM token | SCIM tokenA SCIM token can also create and change users, and Canva has no read-only one. Safeguard only reads with it. Safeguard's compliance tests for Canva need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Carta | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ChatGPT | API token | Workspace ID, Compliance API key | Compliance APINeeds ChatGPT's Enterprise or Edu plan. Needs a ChatGPT Enterprise or Edu Compliance API key and the workspace ID. An API key from platform.openai.com does not work here: connect it with the OpenAI API Platform card. | Docs |
| Claude (Anthropic) | API token | Organization admin API key, Organization ID (optional) | Claude Console: Admin API key (admin role), Claude Enterprise: read:members, read:compliance_org_data, read:compliance_activitiesClaude Console: an Admin API key (sk-ant-admin01-…) from Console › Settings › Admin keys; Anthropic issues no read-only one, and Safeguard only reads with it. Claude Enterprise: a key from claude.ai › Organization settings › API with only the read scopes listed. A Claude API key (sk-ant-api03-…) does not work here. | Docs |
| Cohere | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| DeepSeek | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| ElevenLabs | API token | API key | workspace_members_read, workspace_read, audit_log_readCreate the key on a service account with only workspace_members_read, workspace_read and audit_log_read. ElevenLabs keeps the audit log on Enterprise plans. | Docs |
| Figma | API token, MCP server | Tenant ID, SCIM token, Environment (optional) | SCIM API tokenNeeds Figma's Organization or Enterprise plan. Safeguard's compliance tests for Figma need the credential on the API token tab: an OAuth connection cannot read everything they check. | Docs |
| Fireworks AI | API token | API key, Account ID | admin role (an admin service account)Fireworks AI issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. Needs the API key of an admin, best an admin service account (firectl user create --service-account --role admin), and your account ID. Listing every user's keys needs the admin role. | Docs |
| Groq | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Hugging Face | API token | Access token, Organization | organization admin (fine-grained token), Team or Enterprise planHugging Face issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. Needs an access token of an organization admin (or an Enterprise service account) and the organization's name. Hugging Face shows members' emails and tokens only on Team and Enterprise plans. | Docs |
| API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — | |
| Microsoft 365 Copilot | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Mistral AI | API token | Organization admin API key | Admin API key (organization admin)Needs Mistral AI's Enterprise plan. Mistral AI issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. Needs a Mistral Admin API key, created in the Mistral console › API keys. The Admin API is in preview and needs an Enterprise plan. A standard API key does not work here. | Docs |
| OpenAI API Platform | API token | Organization admin API key | Admin API key (organization Owner)OpenAI API Platform issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. Needs an OpenAI Admin API key (sk-admin-…), created by an organization Owner at platform.openai.com › Settings › Organization › Admin keys. A project API key or a ChatGPT Compliance API key does not work here. | Docs |
| OpenRouter | API token | Management key | Management API key (Org Admin)OpenRouter issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. Needs an OpenRouter management API key, created by an Org Admin on the Management API Keys page. A model API key does not work here. | Docs |
| Perplexity | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Replicate | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Stripe | API token, MCP server | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| Together AI | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
| xAI | API token | Management key, Team ID (optional) | Management key (team scope)xAI issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. Needs an xAI management key from console.x.ai › Settings › Management Keys, scoped to your team. Leave the team ID blank to use the key's own team. An API key for the models does not work here. | Docs |
| Z.ai (Zhipu GLM) | API token | API token / Personal access token, Base URL (optional), Account / Org / Workspace (optional) | — | — |
Z.ai (Zhipu GLM)
Connect Z.ai (Zhipu GLM) to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Frameworks and connectors
How connectors provide evidence for compliance frameworks, which frameworks the automated tests map to, and how to cover any other framework.