Fireworks AI
Connect Fireworks AI to Safeguard. The service account roles the key needs for the inventory and the access tests, and step-by-step setup.
Availability
The model inventory is switched on per workspace. If you do not see it on the Fireworks AI card under Integrations, ask your Safeguard contact.
What it does
On the Fireworks AI connection Safeguard reads two things. The model inventory lists the account's own models (uploaded and imported models, LoRA add-ons, merged models), its deployments (base model, accelerators, replica range and route) and its supervised fine-tuning jobs, with where each model came from; it feeds the asset inventory and model provenance tests (Fireworks reports no licence and no model version, so the licence and version pinning tests are not run for it). The access tests read the account's users, every user's API keys, the audit log and the zero data retention policy. Find the Fireworks AI card under Integrations on the Project/Product tab (the AI Model filter shows only AI model cards). Nothing it reads is sent to a model: no customer data goes to third-party LLMs.
Public vs private
| Public | Private | |
|---|---|---|
| What you enter | Nothing: there is no public mode | An API key and the account ID |
| Credential needed | Not applicable | The API key of a service account |
| What you can scan | Not applicable | The account's models, deployments, fine-tuning jobs and, with an admin key, its users and keys |
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
| API key of an inference-user service account | You want the inventory only | The narrowest key: views every resource but cannot create or change any |
| API key of an admin service account | You also want the access tests | Listing every user's API keys is for admins only |
Permissions required
Safeguard only reads: it sends GET requests and nothing else. For the inventory, give the service account the inference-user role; for the access tests as well, use an admin service account.
API key of an inference-user service account
| Permission / scope | Required? | What Safeguard uses it for |
|---|---|---|
Role inference-user (or user, contributor, admin): "View all resources" | Required | GET /v1/accounts/{account_id}/models, /deployments and /supervisedFineTuningJobs |
| Account ID | Required | Names the account in every call |
Least privilege: an inference-user service account. Every Fireworks role can view all resources; inference-user is the one that cannot create or modify them.
API key of an admin service account
| Permission / scope | Required? | What Safeguard uses it for |
|---|---|---|
Role admin | Required for the access tests | GET /users, GET /users/-/apiKeys (admins only), GET /auditLogs, GET /policySettings, plus the inventory reads |
| Account ID | Required | Names the account in every call |
Token types
| Token type | Works? | Notes |
|---|---|---|
| Service account key, role inference-user | Yes, inventory only (recommended for it) | The inference-user and contributor roles are newer: ask Fireworks support to enable them if firectl refuses the role |
| Service account key, role admin | Yes, inventory and access tests | An elevated grant: it can manage users and keys |
| A person's own API key | Yes, with that person's role | Tied to that person; prefer a service account |
| Read-only vs admin | Fireworks has no view-only role; inference-user is the narrowest (view all resources and run inference, no changes) | An admin key is needed only for the access tests, and it can manage users and keys |
Expiry: rotate the key on your own schedule, for example every 90 days.
What we never need: creating, editing or deleting deployments, models, datasets or jobs; running inference; and the secrets in a deployment's direct route keys or a job's Weights and Biases settings. Safeguard asks Fireworks for the fields it needs only, so those secrets are not returned; if Fireworks refuses that field list, Safeguard reads the list once without it and drops those fields unread.
Step-by-step setup
Create the credential in Fireworks AI
- As an admin of the account, open app.fireworks.ai/account/users to see users and service accounts.
- Create the service account and its key with firectl (below). Only an admin can create a service account's key.
- Copy the key and note the account ID.
Or with the Fireworks CLI
# Inventory only:
firectl user create --user-id "safeguard-inventory" --service-account --role=inference-user
firectl api-key create --service-account "safeguard-inventory"
# Inventory and access tests:
firectl user create --user-id "safeguard-admin" --service-account --role=admin
firectl api-key create --service-account "safeguard-admin"
# Change a role later:
firectl user update safeguard-inventory --role=inference-userConnect it in Safeguard
- Open Integrations and choose the Project/Product tab (optionally the AI Model filter).
- Click Connect on the Fireworks AI card (or edit the existing Fireworks AI connection).
- Enter the API key and the account ID (with or without the
accounts/prefix). The Setup steps section shows the firectl commands above with your account ID filled in, with a copy button. - Save, then click Check access. Safeguard lists one model, then tries to list every user's API keys to see whether the key is an admin's. With an admin key, success reads
The key reads Fireworks account <account>: the inventory (models, deployments, fine-tuning jobs) and, as an admin key, the access tests (users' API keys, audit log, zero data retention).With an inference-user key it says the inventory works and that the access tests need an admin key.
Webhooks and triggers
This integration has no webhooks. The inventory is read each time the connection's tests run, on their schedule or when you run them by hand.
What we read and store
- Read: the account's models, deployments and supervised fine-tuning jobs (and, with an admin key, users, API key metadata, audit log events and the zero data retention policy).
- Stored: the inventory (model, deployment and job names, kinds, base models, accelerators, replica ranges, routes, states, who started each job) in the AI asset inventory, and the test results. An asset that disappears is marked inactive, not deleted. The key is encrypted at rest and never shown again after you save it.
- Not stored or read: datasets, prompts, completions, direct route keys and Weights and Biases keys. Deleted deployments are left out.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Fireworks rejected the API key (HTTP 401): create a new key for a service account (firectl api-key create --service-account <name>, or https://app.fireworks.ai/account/users) and update the connection. | The key was deleted or mistyped | Create a new key and update the connection |
Fireworks AI: the connection has no API key and account ID. | A field is empty | Enter both the key and the account ID |
Fireworks AI: the account ID is not a Fireworks account ID. | The account ID has the wrong form | Enter the ID shown in your Fireworks account (with or without accounts/): letters, digits and hyphens |
Fireworks account <id> was not found for this key: check the account ID. | The key belongs to another account | Enter that key's account ID |
... The key cannot view deployments: give its user or service account the inference-user role (or user, contributor or admin). | The key's role cannot view resources | Change the service account's role |
... It is not an admin key, so the access tests cannot list every user's API keys: use an admin service account's key for those. | An inference-user key on a connection that also runs the access tests | Use an admin service account's key, or accept the access test errors |
... Whether it is an admin key could not be checked. | The admin check did not get a clear answer | Run Check access again; the inventory works either way |
Fireworks AI returned more than <n> pages of <list>; refusing to judge a partial list. | The list is longer than Safeguard reads in one run | Contact Safeguard support |
Could not reach Fireworks AI: ... | Fireworks did not answer | Run Check access again |
Rotation and disconnect
- Rotate: create a new key for the service account, edit the connection in Safeguard, paste it and save, then delete the old key.
- Disconnect: delete the connection in Safeguard, then delete the key, or the service account, in Fireworks.
Vendor references
- List models, checked 2026-10-16.
- List deployments, checked 2026-10-16.
- List supervised fine-tuning jobs, checked 2026-10-16.
- Users and roles, checked 2026-10-16.
- Service accounts, checked 2026-10-16.