Contrast Security

Connect Contrast Security to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Contrast Security:

   1. Hosted (SaaS) Contrast: from the user menu, select Organization settings, then select Access control and the Users tab.
   2. Select Add user, enter the user's first name, last name and email address, select the API access option, and select Add.
   3. In the Users list, confirm the new user shows the API label in the Type column, then select the API icon in the Type column and copy the Service key.
   4. On-premises Contrast: from the user menu, select Organization settings › Users › Add User, enter the user name, email address and time zone, select the Role, select an Application access group with View access, select the API only checkbox, then hover over the API only label next to the user's name and copy the Service key.
   5. To use your own user's keys instead: go to User menu › User settings › Profile; under Your keys you can see the API key, Organization ID and Service key.
   6. Grant the API user View access through the Application access group (least permissive). If you use access groups to restrict applications, add the API user to the groups for the applications Safeguard should read.

   Where to find the other values:

   • API key: User menu › User settings › Profile › Your keys shows the API key (shared across all users in the organization).
   • Username: The email address / user name of the API user you created.
   • Organization ID: User menu › User settings › Profile › Your keys shows the Organization ID.
   • Base URL (optional): The address of your Contrast instance (the host you sign in to).

   API only users cannot log in to the web interface. The service key is unique per user; the API key and Organization ID are shared. The Authorization header is base64(username:service_key). Rotating a service key (Rotate) breaks integrations using it until updated. The fetched pages do not name the role needed to create an API only user. With role-based access control, the hosted page says the View application action should be sufficient for scripts that pull data; the on-premises page recommends the least permissive role and View access.

   Source: docs.contrastsecurity.com, docs.contrastsecurity.com, docs.contrastsecurity.com, checked 2026-10-07.

   The permissions Safeguard needs: View.

2. On Compliance › Connectors, open Contrast Security, click Connect, choose API token and fill in:

   Field	What to enter
   API key	Required. Stored encrypted and never shown again.
   Username	Required.
   Service key	Required. Stored encrypted and never shown again.
   Organization ID	Required.
   Base URL (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Contrast Security and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks