Chainguard

Record your Chainguard connection as vulnerability scanning evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Chainguard:

   1. Chainguard issues API tokens through its chainctl command-line tool, not a web form.
   2. Install chainctl and run chainctl auth login; it opens a browser to sign in to Chainguard.
   3. Run chainctl auth token to print an API token for the signed-in identity, and paste it into Safeguard.

   Where to find the other values:

   • Base URL (optional): Chainguard's documented API endpoint is https://console-api.enforce.dev (for example /iam/v1/groups).
   • Account / Org / Workspace (optional): Your Chainguard organization name, as returned in the name field of GET https://console-api.enforce.dev/iam/v1/groups.

   Chainguard issues this credential through its API or its support team, not through its admin screens.

   Tokens from chainctl auth token belong to the signed-in user, and the fetched page does not state their lifetime. For unattended access Chainguard documents assumable identities (https://edu.chainguard.dev/platform/administration/assumable-ids/identity-examples/); a viewer-only role binding was not verified from fetched docs.

   Source: edu.chainguard.dev, checked 2026-10-07.

2. On Compliance › Connectors, open Chainguard, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Chainguard yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks