JFrog Xray

Connect JFrog Xray to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In JFrog Xray:

   1. In the JFrog Platform Administration module, go to User Management | Access Tokens.
   2. From the Token scope field, select User (or Group), then select the user in the Users field (or the group in the Groups field).
   3. In the Service field, select All, or clear the checkbox and select only the services Safeguard needs (Xray).
   4. In the Expiration time field, set the expiration time for the token.
   5. Click Generate, then click Copy to copy the token. Tokens are not stored in the JFrog Platform; once the window is closed the token is no longer available.

   Where to find the other values:

   • Instance URL: The base URL of your JFrog Platform deployment (the address you use to sign in, for example https://<company>.jfrog.io).

   JFrog Xray shows the secret only once, so copy it before you leave the page.

   JFrog Xray's public documentation does not cover every step.

   Since Artifactory 7.21.1 access tokens are scoped tokens: REST API access is always provided, plus the group memberships the token carries. Avoid Generate Admin Token. The permission target setup for Read on watched resources is in JFrog's permissions docs and was not fetched here. Verification: the step to create a user or group with Read-only permissions was removed because the fetched page does not describe it.

   Source: docs.jfrog.com, checked 2026-10-07.

   The permissions Safeguard needs: Read on the watched resources.

2. On Compliance › Connectors, open JFrog Xray, click Connect, choose API token and fill in:

   Field	What to enter
   Instance URL	Required. For example: https://acme.jfrog.io
   Access token	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read JFrog Xray and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks