Kion
Connect Kion to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Record your Kion connection as cspm evidence. Automated collection is not available for this provider yet.
| Category | CSPM |
| Connect with | API token |
| What a connection produces | Connection record |
Connect with an API token
-
In Kion:
- Click the user menu in the top right corner of Kion and select App API Keys.
- Click Add, enter a name for the key and click Create App API Key.
- Click anywhere in the App API Key field to copy it; you cannot view the token again after closing the modal. Paste it into Safeguard's API token / Personal access token field.
- If key generation is off, a Kion admin goes to Settings › System Settings, under Application Settings selects App API Access, enables App API Key Generation, sets API Key Limit Per User (and optionally App API Key Lifespan), and clicks Update App API Access Settings.
- To create the key as a non-admin user, that user needs the Manage Own App API Keys permission, assigned through permission schemes in Settings › Permissions.
Where to find the other values:
- Base URL (optional): Not shown in a documented UI location; it is the address of your Kion installation.
- Account / Org / Workspace (optional): Not shown in a documented UI location.
Kion shows the secret only once, so copy it before you leave the page.
By default only administrators can generate App API keys. Keys expire according to the App API Key Lifespan setting if one is configured. Kion documents no read-only key scope; least privilege comes from the creating user's permission scheme.
Source: support.kion.io, support.kion.io, checked 2026-10-07.
-
On Compliance › Connectors, open Kion, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Kion publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Attestation | CC7.1 | 1 |
| ISO/IEC 27001 | Attestation | A.8.8 | 1 |
| HIPAA Security Rule | Attestation | 164.308(a)(1) | 1 |
| PCI DSS | Attestation | 6.3.3, 11.3.1 | 1 |
| NIST CSF 2.0 | Attestation | ID.RA-01 | 1 |
These tests are switched on per workspace by the Safeguard team.
Related
- CSPM connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks