Opal

Connect Opal to collect user access review evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Opal:

   1. Sign in to Opal as an Opal Admin (by default only admins can create personal access tokens; an admin can let all users create them with Allow all users to create PATs under Organization Settings -> Advanced).
   2. Go to the User -> Settings page and generate a personal access token.
   3. Choose Read-only as the token type. Read-only tokens can only perform GET requests, limited to resources the token's owner can view.
   4. Copy the token and paste it into Safeguard.
   5. Alternative: create a service user on Organization Settings -> Service Users, give it Opal roles under the Resources tab (and groups under the Groups tab), then create its key under the API Keys tab, optionally with an expiry. A service user can have at most 2 API keys.

   Opal's public documentation does not cover every step.

   Source: docs.opal.dev, checked 2026-10-07.

   The permissions Safeguard needs: read-only token.

2. On Compliance › Connectors, open Opal, click Connect, choose API token and fill in:

   Field	What to enter
   API token	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Opal and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• User Access Review connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks