VictoriaMetrics

Connect VictoriaMetrics to collect observability evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In VictoriaMetrics:

   1. Self-hosted: VictoriaMetrics has no UI for credentials. Put vmauth (the VictoriaMetrics auth proxy) in front of your server and add a user for Safeguard in the vmauth config file, either with a bearer_token value or with username and password, and a url_prefix pointing at your VictoriaMetrics instance.
   2. VictoriaMetrics Cloud: open your deployment, select the Access tokens tab and click Generate Token.
   3. Enter a token name, select the Read access level (read-only access) and click Generate. Then click the value under the Key column for the token; the secret value is copied to your clipboard. Paste it into Safeguard as the bearer token.

   Where to find the other values:

   • Server URL: Self-hosted: the https address of your vmauth proxy. VictoriaMetrics Cloud: the deployment access endpoint shown on the Access tokens and Overview tabs of the deployment.
   • Bearer token (optional): The bearer_token you set for the user in the vmauth config, or the Cloud access token.
   • Username (optional): The username you set for the user in the vmauth config.

   VictoriaMetrics's public documentation does not cover every step.

   VictoriaMetrics' page does not say whether a Cloud token's secret can be copied again later. For self-hosted, read-only is enforced by which url_prefix paths you route in vmauth; the exact read-only route config was not verified. The Alertmanager URL is your own Alertmanager address; no vendor-side lookup is documented.

   Source: docs.victoriametrics.com, docs.victoriametrics.com, checked 2026-10-07.

   The permissions Safeguard needs: read access through your proxy.

2. On Compliance › Connectors, open VictoriaMetrics, click Connect, choose API token and fill in:

   Field	What to enter
   Server URL	Required. Your own server: an https address reachable from the internet.
   Alertmanager URL (optional)	Your own server: an https address reachable from the internet.
   Bearer token (optional)	Stored encrypted and never shown again.
   Username (optional)	—
   Password (optional)	Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read VictoriaMetrics and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Observability connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks