Open Policy Agent

Record your Open Policy Agent connection as infrastructure evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Open Policy Agent:

   1. OPA has no UI that issues API tokens. Start the OPA server with --authentication=token and --authorization=basic so it requires a Bearer token.
   2. Define the token Safeguard will use in your system.authz authorization policy (tokens may be defined in policy or pushed into OPA as data), granting it read-only access to the endpoints Safeguard calls.
   3. Paste that token into Safeguard's API token / Personal access token field and your OPA server's https address into Base URL.

   Where to find the other values:

   • Base URL (optional): The https address of your own OPA server.
   • Account / Org / Workspace (optional): Not applicable to self-hosted OPA; the docs define no such value.

   Open Policy Agent issues this credential through its API or its support team, not through its admin screens.

   Source: openpolicyagent.org, checked 2026-10-07.

2. On Compliance › Connectors, open Open Policy Agent, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Open Policy Agent yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks