Orca Security

Record your Orca Security connection as cspm evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Orca Security:

   1. Create an API token in the Orca platform by following Orca's guide Managing API Tokens (docs.orcasecurity.io/docs/managing-api-tokens). That guide is only readable after signing in to Orca, so the menu path is not given here.
   2. Give the token enough permissions to read the Orca resources you need; Orca's official tooling only says the API token must have enough permissions to access Orca Security resources.

   Where to find the other values:

   • API token / Personal access token: The token you create under Orca's API token management (see Managing API Tokens). Orca's API takes it in an Authorization header as "Token <your token>".
   • Base URL (optional): Orca's official Terraform provider and MCP examples use https://api.orcasecurity.io as the API endpoint. Orca's docs sit behind a region-selection sign-in, so check with Orca whether your account uses a different regional endpoint.
   • Account / Org / Workspace (optional): No public official source names an organization identifier for API calls; leave blank unless Orca tells you otherwise.

   Orca Security keeps the full instructions behind sign-in; this is what its public pages say.

   Orca's documentation (docs.orcasecurity.io) redirects to a region-selection sign-in gate, so the token-creation steps, role choices and whether the token is shown only once could not be read. The orcasecurity GitHub organization confirms the guide's location (Managing API Tokens), the endpoint https://api.orcasecurity.io and the 'Authorization: Token <token>' header, but has no UI click path. Orca's MCP server is at https://api.orcasecurity.io/mcp.

   Source: docs.orcasecurity.io, raw.githubusercontent.com, raw.githubusercontent.com, checked 2026-10-07.

2. On Compliance › Connectors, open Orca Security, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

Orca Security publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.

These tests are switched on per workspace by the Safeguard team.

Related

• CSPM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks