Connect your stack. Evidence collects itself.

1Password Business

Collect 1Password Business user roster, group membership, and vault access-control evidence via the read-only Business API.

User roster and account state
Group membership and admin roles

AbuseIPDB

Collect IP address reputation, blacklist, and block check evidence from AbuseIPDB API v2.

IP address blacklist status
IP block reputation and block verification

ADP Workforce Now

Collect ADP Workforce Now worker and organizational data through the read-only ADP HR/Payroll API to support employee-lifecycle and access-review evidence.

Worker / employee inventory
Organizational role and status data

AlienVault

Collect AlienVault USM Anywhere alarms and events, as well as OTX threat intelligence pulse evidence through read-only API endpoints.

AlienVault USM Anywhere alarm inventory
AlienVault USM Anywhere event inventory

Amazon S3 bucket exports

Upload a CSV export of Amazon S3 buckets mapping bucketName, publicAccessBlockEnabled, and defaultEncryptionEnabled.

S3 bucket inventory tracking
Public access block enforcement (pass value: true / enabled)

Collect organization member, workspace, and API-key inventory as read-only AI-governance compliance evidence through the Anthropic Admin API. Scoped strictly to organization/access evidence -- not model usage content or conversation data. Requires an Admin API key (distinct from a regular API key), sent as the `x-api-key` header alongside an `anthropic-version` header. Note: Anthropic's Admin API requires the `anthropic-version` header on every request, which this generic HTTP connector's single configurable auth-header does not cover by default -- flag this as a known limitation.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Asana

Audit Asana workspace members and projects as read-only work-management access-review and inventory evidence.

Elevated admin accounts flagged for access review
External guest accounts flagged for review visibility

Ashby

Audit Ashby ATS/recruiting accounts and job posting inventory as read-only access-review and hiring-pipeline evidence.

Enabled admin/org-admin accounts flagged for access review
Open/live job posting inventory

Auth0

Audit MFA factors, breached-password & brute-force protection, and tenant settings.

Multi-factor authentication factors enabled
Breached-password detection enabled

AWS

Audit S3 public-access/encryption and IAM user MFA.

S3 buckets without public-access block
S3 buckets without default encryption

Azure Blob storage exports

Upload a CSV export of Azure Blob storage containers mapping containerName, publicAccess, and encryptionStatus.

Container inventory tracking
Public access level checks (pass value: None / Private)

Azure DevOps

Collect Azure DevOps project, repository, and pipeline evidence through organization-scoped APIs.

Project inventory
Repository, pipeline, recent-build, and policy evidence when project names are provided

Backblaze B2 exports

Upload a CSV export of Backblaze B2 buckets mapping bucketId, bucketName, and bucketType.

Bucket inventory tracking
Private vs public bucket posture (pass value: allPrivate)

BambooHR

Collect BambooHR employee roster, status, and onboarding/offboarding date evidence through company-scoped API endpoints.

Employee directory
Employee roster with status, hire date, and termination date fields

Better Stack

Push log-retention, uptime-monitor, alerting-coverage, and access evidence from Better Stack Logs/Uptime through an approved export or automation path -- Better Stack's public API surface for team/member access evidence is not confidently documented, so this is a webhook (push) template rather than a bespoke read connector.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

BI/reporting webhooks

Push report availability, data freshness, or dashboard evidence from BI systems.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

Bitbucket

Collect workspace and repository evidence from Bitbucket Cloud APIs.

Authenticated user visibility
Workspace repository inventory when a workspace is provided

Box

Collect Box user, group, and enterprise event-log evidence through the read-only Box Platform API to support access-review and data-handling audits.

User and group inventory
External collaboration / sharing posture

BreezyHR

Audit BreezyHR recruiting-team user accounts and open position inventory as read-only ATS access-review and hiring-pipeline evidence.

Admin privilege flags on active recruiting-team accounts
Open position inventory per company

Brevo

Collect account info and verified-sender inventory as read-only 'who can send as us' access-review evidence through the Brevo (Sendinblue) API. Scoped strictly to access evidence, not campaign or contact data. Brevo's confirmed team/user-management endpoints are gated behind its Corporate/multi-account plan tier and are not confidently documented for standard accounts, so 'who has admin' evidence is NOT covered here -- track it manually until confirmed.

Account plan/company info (read-only)
Verified sender inventory

Brex

Audit Brex team-member roster and roles as finance-system access-review evidence (who can move money).

Team member roster with status and role
Inactive accounts retaining admin/owner/bookkeeper roles

Buildkite

Collect pipeline and build-run inventory as read-only CI/CD compliance evidence through the Buildkite REST API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Carbon Black (VMware Carbon Black Cloud)

Collect device/endpoint coverage and alert evidence as read-only EDR compliance signal through the VMware Carbon Black Cloud API. Substitute your CBC console hostname for <your-cbc-host> and your org key for <org-key> in each endpoint path.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Checkr

Collect Checkr background-check report status and package/order configuration as pre-employment screening compliance evidence.

Background check report status
Screening package configuration

CI/CD and deploy webhooks

Push build, deploy, approval, and required-check evidence from CI/CD systems.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

CircleCI

Collect CircleCI account, context, and project environment-variable evidence through API v2.

Authenticated user visibility
Context inventory when an owner slug is provided

Cisco Meraki

Collect Meraki organization, network, and device inventory plus admin 2FA status through the read-only Meraki Dashboard API.

Organization inventory
Network inventory

Cisco Secure Endpoint

Collect endpoint/computer coverage and detection-event evidence as read-only EDR compliance signal through the Cisco Secure Endpoint (AMP) API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Cisco Umbrella

Collect Cisco Umbrella DNS security policy, destination-list/blocklist, and roaming-client deployment evidence through the read-only Umbrella API.

Deployment policy inventory
Destination list / blocklist posture

Clerk

Audit Clerk user MFA enrollment, banned/locked status, and organization admin membership.

Active users without MFA (TOTP/backup codes) enrolled
Banned or locked account inventory

ClickUp

Audit ClickUp workspace members and spaces as read-only project-management access-review and inventory evidence.

Owner/admin accounts flagged for elevated-privilege access review
Guest accounts flagged for review visibility

Cloudflare

Collect Cloudflare zone security settings, firewall/WAF rule configuration, and account member access as DNS/edge-security compliance evidence.

Zone security settings (SSL/TLS, DNSSEC)
Firewall/WAF rule configuration

Cloudways

Connect Cloudways API v2 by entering the current API base URL and read-only evidence endpoints from the Cloudways API Playground.

Read-only server/application inventory endpoints
Customer-supplied Cloudways API v2 paths

Codefresh

Collect pipeline and workflow-run inventory as read-only CI/CD compliance evidence through the Codefresh API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Comms and alerting webhooks

Push escalation, alert-delivery, incident-notification, or on-call evidence from alerting systems.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

Confluence

Collect Atlassian Confluence space membership, permission, and audit-log evidence through the read-only Confluence Cloud REST API.

User and group inventory
Space permission posture

Coralogix

Collect Coralogix alert, parsing-rule, and outbound-webhook configuration evidence through documented read-only HTTP endpoints.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

CouchDB

Audit Apache CouchDB cluster membership, admin configuration, anonymous-access settings, and per-database security docs through read-only REST calls.

Cluster node membership
Admin-party detection (no admins configured)

CrateDB

Audit CrateDB user inventory, privilege grants, and cluster node health through read-only SQL system queries.

User and superuser inventory
Privilege grant review

CrowdStrike Falcon

Audit sensor coverage, reduced-functionality and stale hosts, and detections.

Sensor coverage across hosts
Hosts in reduced-functionality mode

Database inventory exports

Upload database role/grant, TLS, audit-log, or configuration exports.

Role/grant inventory
Optional compliance column for TLS/audit controls

Databricks

Collect cluster configuration, job, and workspace-user inventory as read-only compliance evidence through the Databricks REST API (self-hosted workspace). Substitute your workspace URL for the <your-workspace> placeholder in the base URL.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Datadog

Audit monitor coverage, log retention, audit-trail readability, and users.

Monitors configured
Log index retention coverage

Deel

Audit Deel global payroll/EOR worker roster as read-only HR access-review and offboarding evidence.

Active worker roster with hire dates, job title, and team/department
Terminated workers missing termination dates

Docs

DigiCert

Collect certificate order and expiry-date inventory as read-only PKI/TLS-lifecycle compliance evidence through the DigiCert CertCentral API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Docs & trust evidence

DigitalOcean

Collect DigitalOcean cloud-infrastructure evidence (droplet/resource inventory, firewall configuration, and team member access) for cloud configuration and access-review compliance.

Droplet/resource inventory
Firewall configuration

Discord

Collect guild (server), member, and role inventory as read-only compliance evidence through the Discord bot REST API, for orgs using Discord as an internal comms/alerting channel.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Docs

Docs and e-sign exports

Upload policy-signoff, document, attestation, or e-signature exports.

Policy acknowledgement evidence
Optional signed/approved compliance column

Docs & trust evidence

DocuSign

Collect DocuSign envelope, template, user, and account evidence through read-only REST API endpoints.

Envelope status and metadata
Template inventory

Dropbox Business

Collect Dropbox Business team member, group, and activity-log evidence through the read-only Dropbox Business API for access-review audits.

Team member inventory
Group and permission posture

Dropbox Sign

Collect Dropbox Sign (HelloSign) account, team, and signature-request evidence through the read-only API to support e-signature and document-control audits.

Team member inventory
Signature request activity and status

DuckDB

Audit a DuckDB instance exposed via an HTTP query endpoint (e.g. a MotherDuck-compatible or self-hosted SQL-over-HTTP proxy), not a local file. Checks attached-database read-only posture, external access / unsigned extension settings, and loaded extension inventory through read-only SQL introspection.

Attached database read-only posture
External access and unsigned-extension settings

Duo Security

Collect Duo Security MFA evidence (user enrollment status, authentication device inventory, and administrator access) for multi-factor authentication compliance.

User MFA enrollment status
Authentication device inventory

Dynatrace

Collect monitored-entity and problem/alert inventory as read-only observability compliance evidence through the Dynatrace Environment API v2.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Elastic Security / Kibana

Collect detection-rule and alert inventory as read-only SIEM compliance evidence through the Kibana/Elastic Security API (self-hosted or Elastic Cloud).

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

F5 BIG-IP

Collect F5 BIG-IP system readiness, licensing, provision status, and LTM virtual server configurations via the iControl REST API.

System readiness status
System licensing details

Fleet

Collect Fleet (osquery) host inventory, policy compliance, and user access evidence through the read-only Fleet REST API for device-posture and endpoint-management controls.

Device / host inventory and posture
Policy compliance status

Fortinet FortiGate

Collect firewall configuration, policies, system status, and system logs from Fortinet FortiGate devices via the FortiOS REST API.

Firewall system status and firmware version
Firewall security policies and rules configuration

Freshdesk

Collect read-only Freshdesk agent, role, and group evidence through the Freshdesk API v2 for access-review evidence. This is not a general ticketing/task-automation connector.

Agent roster and active/occasional status for access review
Role inventory and assignment for least-privilege review

Freshservice

Collect Freshservice agent, requester, and audit-log evidence through the read-only Freshservice ITSM API to support access-review and change-management audits.

Agent and role inventory
Requester / user inventory

Generic e-Signatures

Collect signature agreement, template, user, and transaction log evidence from standard e-signature REST endpoints.

Document and signature status
Template configuration and settings

Generic transport/protocol evidence

Push normalized evidence from GraphQL, SFTP, SSH, LDAP, Kafka, AMQP, MQTT, or another bridge.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

Gitea

Collect repository, branch, collaborator, organization, and pull-request evidence through the Gitea API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

GitGuardian

Collect GitGuardian secrets-detection evidence (incident inventory, source/perimeter coverage, and team member access) for secret-scanning compliance attestations.

Secret leak incident inventory
Monitored source/perimeter coverage

GitHub

Audit repository branch protection, visibility, and member 2FA.

Default-branch protection & required reviews
Unexpectedly public repositories

GitLab

Audit group 2FA enforcement, protected branches, MR approvals, and CI/CD secrets.

Group two-factor enforcement
Public project visibility

Google BigQuery

Collect dataset, table, and job-history inventory as read-only compliance evidence through the BigQuery REST API. Substitute your GCP project ID for the <project-id> placeholder in each endpoint path.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Google Cloud

Audit project IAM, service-account keys, Cloud Storage, and log sinks.

Project/org IAM public principals and broad basic roles
User-managed service-account keys older than 90 days

Google Workspace

Audit users, 2-step verification, super admins, and OAuth app grants.

Active users not enrolled or enforced for 2-step verification
Super-admin inventory and super-admin 2SV gaps

Grafana

Collect user, organization, datasource, and alert-rule inventory as read-only observability compliance evidence through the Grafana HTTP API (self-hosted or Grafana Cloud).

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Greenhouse

Audit Greenhouse recruiter/hiring-manager accounts and live job postings as read-only HR/ATS access-review and hiring-pipeline evidence.

Active site-admin accounts flagged for access review
Live/published job posting inventory

Gusto

Collect Gusto HR roster and termination evidence through documented read-only API endpoints.

Employee roster evidence when company IDs are provided
Employee termination records when employee IDs are provided

HackerOne

Collect HackerOne program, report, and member evidence through the read-only HackerOne API to support vulnerability-management and bug-bounty audits.

Vulnerability report inventory and status
Program member / role inventory

HashiCorp Vault

Collect HashiCorp Vault authentication method, policy, and audit-device configuration evidence through the read-only HTTP API for secrets-management and access-control controls.

Auth method inventory
Policy / access control configuration

Heroku

Collect Heroku deployment-platform evidence (team member access, app inventory, and config-var/add-on posture) for change-management and access-review attestations.

Team member access list
Application inventory

Hetzner Cloud

Collect server, firewall, network, and SSH-key inventory through the Hetzner Cloud API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

HiBob

Audit HiBob HR roster (active/terminated workers, hire and termination dates) as read-only access-review and offboarding evidence.

Active worker roster with hire dates, title, department, manager
Terminated workers missing termination dates

HR and recruiting exports

Upload roster, hiring, termination, department, or recruiting exports from Tier 2 HR systems.

Roster/offboarding evidence
Optional active/terminated compliance column

HubSpot

Collect HubSpot user, team, and audit-log evidence through the read-only CRM API for access-review and change-tracking controls.

User and permissions inventory
Team membership structure

IBM QRadar

Collect security offenses and asset inventory as read-only SIEM compliance evidence through the IBM QRadar REST API (self-hosted).

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Imperva WAF

Collect Imperva Cloud WAF site inventory and status/WAF-mode posture through the documented Imperva Cloud Security API. Customer supplies the account's API ID/key as the Authorization header value; site-specific security-rule evidence requires a documented site ID and is left customer-configured.

Protected site (domain) inventory
Site status and WAF security mode/posture

incident.io

Collect incident-response records and responder roster as BC/DR and SOC 2 CC7 evidence.

Incident inventory with severity/status and time-to-close
Long-running open incidents flagged for review

Intercom (Access Review)

Audit Intercom workspace admin roster as access-review evidence (who has admin access). Scoped to admin/access evidence only, not conversation or contact data.

Workspace admin roster with inbox-seat and team assignment

Intruder

Collect open vulnerability issues and scanned-target inventory as read-only compliance evidence through the Intruder API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Jamf

Collect Jamf device inventory and compliance evidence through read-only Jamf Pro API endpoints.

Computer inventory
Mobile device inventory

Jenkins

Collect Jenkins job, node, controller, and plugin evidence through read-only JSON API endpoints.

Job inventory
Agent/node inventory

Jira

Collect Jira project and change-ticket evidence through read-only Jira REST endpoints.

Project inventory
Jira Cloud issue evidence when JQL searches are provided

JumpCloud

Collect user, group, and managed-system evidence from JumpCloud read APIs.

User inventory
Group inventory

Justworks

Audit Justworks PEO/HR employee roster as read-only access-review and offboarding evidence: active worker hire dates and terminated worker termination dates.

Active worker roster with hire dates, title, department, manager
Terminated workers missing termination dates

Kandji

Collect Kandji device and blueprint evidence through read-only Kandji API endpoints.

Device inventory
Blueprint inventory

KnowBe4

Collect security awareness training and phishing simulation evidence from KnowBe4 read APIs.

User inventory
Group inventory

LDAP / Active Directory

On-prem/hybrid directory bind: user roster, group membership, disabled/stale accounts, and password-policy attributes for access-review + deprovisioning evidence. NOT YET IMPLEMENTED — config/registration only; see the TODO in ldap.ts for the missing client-library dependency.

User roster and disabled/stale account inventory (NOT YET IMPLEMENTED)
Group membership (NOT YET IMPLEMENTED)

Lever

Audit Lever recruiting/hiring team accounts and published job postings as read-only access-review and offboarding evidence.

Super-admin privilege flags on team member accounts
Active team members missing an email address

Linear

Collect Linear team and issue evidence through the Linear GraphQL API.

Team inventory
Recent issue evidence

Linode (Akamai)

Collect instances, firewalls, users, and account-event evidence through Linode API v4.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

LogRocket

Push normalized frontend session, issue, performance, or alert evidence from LogRocket through an approved export or automation path.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

Logsnag

Receive normalized incident, alert, monitor, or log-source evidence derived from Logsnag event streams.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

Looker

Collect Looker user, group, role, dashboard, and Look metadata through documented Looker API 4.0 read endpoints.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Mercury

Collect cash-account inventory as read-only finance-system evidence through the Mercury API. Mercury's public API does not document a team-member/role or money-movement-permission listing endpoint as of this writing, so 'who can move money' access-review evidence is NOT covered here -- track it manually (e.g. via Mercury's dashboard team-permissions screen) until Mercury documents one.

Cash account inventory (read-only)
Money-movement permission evidence NOT covered (no documented endpoint) -- track manually

Metabase

Collect Metabase user, group, collection, database, dashboard, and card inventory through documented read-only API endpoints.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Microsoft Azure

Collect Azure subscription and posture evidence through read-only Azure Resource Manager endpoints.

Subscription inventory
Subscription-scoped RBAC, Defender, NSG, and storage-account evidence when subscription IDs are provided

Microsoft Azure Monitor

Collect diagnostic-settings and activity-log configuration as read-only logging/audit-trail compliance evidence through the Azure Resource Manager API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Microsoft Defender

Collect Microsoft Defender alert, incident, secure score, and device evidence through Microsoft Graph security endpoints.

Security alerts
Security incidents

Microsoft Entra ID

Collect directory, role, and policy evidence through Microsoft Graph read-only endpoints.

User and guest-account inventory
Group inventory

Microsoft Intune

Collect managed-device, enrollment-summary, and compliance-policy evidence through Microsoft Graph Intune endpoints.

Managed-device inventory, including encryption and enrollment fields
Managed-device enrollment summary

Microsoft SQL Server

Audit SQL Server login inventory, mixed-mode authentication, and database inventory through read-only system-catalog queries.

Server login inventory (disabled/sa account)
Contained database authentication configuration

Microsoft Teams

Collect Microsoft Teams team/channel roster and membership evidence via Microsoft Graph as collaboration access-control documentation.

Team and channel inventory
Team membership and ownership

Mimecast

Collect Mimecast email security policy, threat, and account audit evidence through the read-only Mimecast API to support email-security and phishing-defense audits.

Account and administrator inventory
Threat / malware detection log

MISP

Collect threat-intel attribute and event exports as read-only evidence through the self-hosted MISP API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Monday.com

Collect Monday.com board, item, update, and user evidence through the Monday.com GraphQL API. Use only for change, incident, access-request, or approval evidence.

Board inventory for evidence scope
Recent item and update evidence for configured boards

MongoDB

Audit MongoDB/Atlas authentication status, database inventory, and auth mechanisms through read-only admin commands.

Connection & authenticated-user status
TLS transport (mongodb+srv or ssl/tls param)

MongoDB Atlas

Collect organization, project, cluster, database-user, and access-list inventory through the MongoDB Atlas API v1.0.

Database user inventory and role permissions
Network IP access list and peering configurations

MongoDB self-hosted exports

Upload MongoDB user role, network access-list, or configuration exports.

MongoDB role/grant inventory
Network access-list compliance controls

MySQL

Audit MySQL/MariaDB TLS status, user/auth-plugin inventory, and database inventory through read-only SQL metadata queries.

TLS/SSL enablement
User accounts, auth plugins, and empty-password detection

MySQL exports

Upload a CSV export of MySQL user privileges, TLS status, or server settings.

User privilege and role inventory tracking
SSL/TLS secure-connection enforcement check

Neon

Audit Neon project inventory, branch protection, and project-sharing (collaborator) access.

Project and branch inventory, including protected-branch coverage
Project sharing / collaborator (email-based access) inventory

Netlify

Collect site and deploy inventory as read-only deploy/CI compliance evidence through the Netlify API. Substitute your site ID for the <site-id> placeholder in the deploys endpoint path.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Network security webhooks

Push firewall, WAF, DNS security, certificate, or managed-network posture evidence.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

New Relic

Collect New Relic user roster, authentication domain (SSO) configuration, and alert policy evidence as observability access-control and monitoring documentation.

User roster and role assignment
Authentication domain / SSO configuration

Nightfall.ai

Collect DLP/PII-detection findings and detection-rule inventory as read-only data-loss-prevention compliance evidence through the Nightfall.ai API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Notion

Collect Notion workspace evidence (user/member inventory and page/database content coverage) for documentation and access-review compliance.

Workspace user inventory
Bot/integration capabilities

Object storage exports

Upload S3-compatible, Azure Blob, GCS, or Backblaze bucket/container exports.

Bucket/container inventory
Optional public/encryption compliance column

Observability webhooks

Push monitor, incident, alert, retention, or log-source coverage evidence.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

Okta

Audit active users for MFA enrollment and offboarding gaps.

Active users without an MFA factor
Active users not on the employee allowlist

OmniHR

Audit OmniHR (APAC HRIS) employee roster as read-only HR access-review and offboarding evidence.

Active employee roster with hire dates, title, department, manager
Terminated employees missing termination/last-working dates

OneLogin

Collect user, role, and application-assignment evidence from OneLogin APIs.

User inventory
Role inventory

OpenAI (Admin/Organization)

Collect organization member, project, and API-key inventory as read-only AI-governance compliance evidence through the OpenAI Admin API. Scoped strictly to organization/access evidence, not model usage content or completions data. Requires an Admin API key (distinct from a regular project API key). API keys are listed per-project; substitute your project ID for the <project-id> placeholder in the api-keys endpoint path.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

OpenCTI

Collect indicator, report, malware, and attack pattern evidence from OpenCTI via read-only GraphQL API queries.

Threat intelligence reports status and metadata
Indicators of compromise (IOC) inventory and patterns

Opsgenie

Collect on-call schedules, escalation policies, and team-membership evidence as read-only compliance signal through the Opsgenie REST API. Signl4 is primarily a webhook-receiver product with no meaningful read API; capture Signl4 alerting evidence via the generic comms-alerting-webhook template instead of a bespoke connector.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Oracle Database

Audit Oracle Database account status, audit/login parameters, and DBA role grants through ORDS read-only SQL metadata queries.

Open/admin account and non-expiring password inventory
Audit trail and login security parameters

PagerDuty

Audit escalation policies, on-call coverage, and incident-response readiness.

Escalation policies exist and have rules
On-call coverage and schedules exist

Personio

Audit Personio HR roster (active/inactive employees, hire and termination dates) as read-only access-review and offboarding evidence.

Active employee roster with hire dates, title, and department
Terminated/inactive employees missing a termination or last-working date

Postgres

Audit Postgres security settings, role inventory, and database inventory through read-only SQL metadata queries.

SSL and password-encryption settings
Role and superuser inventory

PostHog

Audit PostHog organization member roles (admin/owner) and 2FA enrollment as observability access-review evidence.

Organization member roster with role level
Admins/owners without two-factor authentication enabled

Power BI

Collect Power BI workspace, report, dashboard, dataset, and workspace-user inventory through documented REST API read endpoints.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Qovery

Audit Qovery organization member roster and roles as deploy/hosting access-review evidence.

Organization member roster with role, flagging admin/owner assignments

Qualys

Collect Qualys asset, detection, and vulnerability scan evidence through read-only Qualys API endpoints.

Asset inventory
Host vulnerability detections

QuestDB

Audit QuestDB table durability (WAL), partitioning hygiene, and server configuration through read-only HTTP query endpoints.

WAL durability on user tables
Partitioning on time-series tables

Rapid7 InsightVM

Collect Rapid7 InsightVM asset and vulnerability evidence through read-only API endpoints.

Asset inventory
Vulnerability catalog definitions

Recorded Future

Collect threat intelligence alerts, IP, domain, and hash risk lists from Recorded Future API.

Threat intelligence alerts search and details
IP address risk list evidence

Redis

Audit Redis authentication, TLS, persistence, and ACL posture through read-only RESP commands.

AUTH/requirepass and TLS transport
Persistence and maxmemory-policy

Render

Collect service and workspace-owner inventory as read-only deploy/hosting compliance evidence through the Render REST API v1. Render's public API does not document a team-member/role-listing endpoint as of this writing, so member-role access-review evidence is NOT covered here -- track it manually until Render documents one, or reclassify to a bespoke connector if that changes.

Service inventory (read-only)
Workspace/owner inventory

Resend

Collect API-key and verified-domain inventory as read-only 'who can send as us' access-review evidence through the Resend API. Scoped strictly to access evidence, not campaign or contact data. Resend's public API does not document a team-member/role-listing endpoint as of this writing, so 'who has admin' evidence is NOT covered -- track it manually until Resend documents one.

API key inventory (read-only)
Verified sending-domain inventory

Rippling

Audit HR roster, employment status, and offboarding dates.

Active worker roster for access reviews
Hire and termination date evidence

Salesforce

Collect Salesforce user access, permission set, and login-history evidence through the read-only REST API for access-review and account-monitoring controls.

User and profile inventory
Permission set assignments

Salesforce (Security & Access)

Collect user roster, profile/permission-set assignments, and login-history evidence as read-only access-review compliance signal through the Salesforce REST API. Scoped to security/identity evidence only -- not sales, marketing, or customer-record data.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Secrets-management exports

Upload vault, secret inventory, rotation, or access-review exports from secrets-management systems.

Secret inventory evidence
Optional rotated/reviewed compliance column

Security tooling webhooks

Push vulnerability, EDR, SIEM, threat-intel, DLP, or training evidence from Tier 2 security tools.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

SecurityScorecard

Collect SecurityScorecard vendor risk ratings, factor scores, and issue findings through the read-only SecurityScorecard API to support third-party risk audits.

Overall and factor-level security ratings
Detected security issue findings

SendGrid (Access Review)

Audit SendGrid teammate roster (who has admin), pending invites, and verified senders (who can send as us). Scoped to access evidence only, not campaign/contact data.

Teammate roster with admin flag and scopes
Pending teammate invitations

SentinelOne

Collect SentinelOne agent and threat evidence through management-console API endpoints.

Agent inventory
Threat inventory

Sentry

Collect Sentry organization member roles, project error-issue inventory, and audit log evidence as error-monitoring access and change-control documentation.

Organization member roles
Project issue/error inventory

ServiceNow

Collect change-request and incident evidence through ServiceNow Table API endpoints.

Change-request inventory
Incident inventory

Shopify (Security & Access)

Collect staff-account roster and API access-scope inventory as read-only access-review compliance evidence through the Shopify Admin API. Scoped strictly to security/access evidence, not storefront, product, order, or customer data.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Shortcut

Audit Shortcut member accounts and projects as read-only project/issue-tracking access-review and workspace inventory evidence.

Enabled owner/admin accounts flagged for access review
Project/workspace inventory

SignNow

Collect SignNow document, template, user, and folder evidence through read-only REST API endpoints.

Document status and signature metadata
Template inventory

SigNoz

Push log-retention, trace/metric-access, and alerting-coverage evidence from a self-hosted or SigNoz Cloud deployment -- SigNoz has no confidently-documented public admin/access-management REST API, so this is a webhook (push) template rather than a bespoke read connector.

Inbound normalized evidence from the customer system or automation tool
Per-integration secret webhook URL

Slack

Collect Slack workspace, user, and channel evidence through read-only Slack Web API endpoints.

Workspace auth visibility
Workspace details

Snowflake

Collect Snowflake access, role, and configuration evidence through the documented Snowflake SQL API.

Role and grant inventory from Account Usage views
User MFA enrollment evidence from Account Usage users

Snyk

Audit open vulnerabilities by severity, license issues, and scan recency.

Open critical/high vulnerabilities per project
License policy issues

SonarQube / SonarCloud

Collect SonarQube/SonarCloud static-analysis evidence (quality gate status, project inventory, and security hotspot findings) for SAST coverage attestations.

Project inventory
Quality gate pass/fail status

Splunk

Collect Splunk index, data-input, and saved-search evidence through management API endpoints.

Index retention inventory
Data-input/log-source inventory

Stripe

Collect Stripe team member roles and API key configuration evidence through the read-only Stripe API for access-review and credential-hygiene controls.

Team member / role inventory
API key configuration and permissions

Stripe (Security Config)

Collect webhook-endpoint configuration and account security settings as read-only PCI-adjacent compliance evidence through the Stripe API. Scoped strictly to security configuration, not payment, billing, or customer financial data, and NOT a substitute for a real PCI DSS assessment. Note: Stripe does not expose API-key listing/rotation status via the API for security reasons, so key-management evidence must be tracked manually.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Supabase

Collect project, database-role, and auth-settings evidence as read-only compliance signal through the Supabase Management API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

SurrealDB

Audit SurrealDB namespace/database configuration and table permissions through read-only SurrealQL introspection queries.

Namespace-level auth methods defined
Database table permissions (flags open/FULL permissions)

Tableau

Collect Tableau Cloud/Server site user, group, project, workbook, and data-source inventory through documented REST API read endpoints.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Tailscale

Collect Tailscale zero-trust network evidence (device inventory, ACL/network policy configuration, and user roles) for network access control compliance.

Device inventory and key expiry
Network (ACL) policy configuration

Teamwork

Collect read-only Teamwork project and task evidence for change, incident, access-request, or approval workflows. This is not a general task-automation connector.

Project and task evidence through Teamwork API read endpoints
Customer-scoped workflow status or approval fields

Tenable.io

Collect Tenable.io vulnerability scan results, asset inventory, and user access/MFA configuration as continuous vulnerability-management evidence.

Vulnerability findings and severity posture
Asset inventory coverage

Terraform Cloud

Collect Terraform Cloud IaC evidence (workspace inventory, run/apply history, and organization member access) for infrastructure change-management compliance.

Workspace inventory
Run/apply history

TheHive

Collect case and alert inventory as read-only SOC/incident-response compliance evidence through the self-hosted TheHive API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Ticketing, ITSM, and approval exports

Upload change, incident, access-request, or approval exports from Tier 2 ticketing/PM systems. This is not a general task-automation connector.

Change/incident evidence
Optional approved/resolved compliance column

TimescaleDB

Audit TimescaleDB security settings, hypertable compression, and retention policies through read-only SQL metadata queries.

SSL and password-encryption settings
Role and superuser inventory

Travis CI

Collect repository, build, and environment-variable-config evidence as read-only CI/CD compliance signal through the Travis CI API.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Trellix ePO

Collect managed-system and policy-assignment inventory as read-only endpoint-security compliance evidence through the Trellix (McAfee) ePolicy Orchestrator remote API (self-hosted). ePO's remote commands return plain text by convention; append `?:output=json` to request JSON where supported by the deployment.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Trello

Audit Trello workspace membership and board inventory as read-only Kanban/task-management access-review and change-management evidence.

Admin-privileged workspace members flagged for access review
Board inventory per workspace

Twilio

Collect account configuration, verified sender numbers, and usage-record evidence as read-only compliance signal for orgs using Twilio as an SMS/voice alerting channel -- analogous to the Discord/Opsgenie templates. Not intended for general consumer messaging content or customer-communication data.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Vercel

Collect Vercel deployment-platform evidence (team member access, project inventory, and environment variable/secret configuration) for change-management and access-review attestations.

Team member access list
Project inventory

VirusTotal

Collect file-hash, URL, and IP-reputation lookup results as read-only malware-analysis compliance evidence through the VirusTotal API v3.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Vultr

Collect instance, user, network, and account-log evidence through Vultr API v2.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Wiz

Collect Wiz cloud security posture findings, vulnerability issues, and configuration compliance results as CSPM evidence via the read-only Wiz API.

Cloud misconfiguration and posture findings
Vulnerability issues by severity

Workday

Collect Workday worker, organization, role, and termination-feed evidence through customer-configured read-only API endpoints.

Customer-configured worker roster, organization/role, and termination-feed endpoints

Wrike

Collect task, folder/project, and contact evidence through the Wrike API v4 for change, access-request, or approval reviews.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

YouTrack

Audit JetBrains YouTrack user accounts and project inventory as read-only issue-tracker access-review and workspace evidence.

Active (non-banned) user inventory
Project inventory (archived vs. active)

Zabbix

Collect host and user inventory as read-only observability compliance evidence through the self-hosted Zabbix JSON-RPC API. Note: Zabbix API is a single JSON-RPC endpoint, not REST resource paths; older Zabbix versions expect the auth token inside the request body/params, while newer versions (6.4+) accept a Bearer auth header -- confirm the customer Zabbix version before configuring the generic connector auth header.

Read-only API inventory endpoint checks
Evidence assets generated through the generic HTTP connector

Zendesk

Collect Zendesk agent roster, role/permission configuration, and account security policy as support-operations access-control evidence.

Agent/admin roster and roles
Account security policy (SSO/2FA)

Zoho Desk

Audit Zoho Desk agent roster and department inventory as read-only helpdesk access-review evidence.

Administrator profiles flagged for elevated-privilege access review
Unconfirmed/pending agent accounts flagged for onboarding review