# Integrating SailPoint with Buildkite

Buildkite is a continuous integration and continuous delivery (CI/CD) platform. Use the Buildkite connector to aggregate organization members as accounts, organization roles and teams as entitlements, and the following non-human identities:

- Cluster-scoped agent tokens
- Cluster-scoped secrets
- Package registry read tokens

The connector is read-only. It does not provision access or retrieve secret values, agent token values, registry token values, or build logs.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

| Feature | Description |
| --- | --- |
| Test connection | Validates the organization slug, API access token, required scopes, Buildkite API availability, organization membership, and access to organization members and clusters. |
| Account aggregation | Aggregates Buildkite organization members as SailPoint accounts. |
| Entitlement aggregation | Aggregates Buildkite organization roles and teams as entitlements. |
| Dataset aggregation | Aggregates agent tokens, cluster secrets, and package registry read tokens as credentials. |

### Non-Human Identity Discovery

- Aggregate Buildkite agent tokens, cluster secrets, and package registry read tokens

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Supported Version

The connector supports the Buildkite REST API v2 at `https://api.buildkite.com/v2`.

## Prerequisites

### Preparing Buildkite

Complete these tasks before you configure the Buildkite source.

1. Ensure your Buildkite organization has API access enabled.
2. Sign in to Buildkite with a user who belongs to the organization and can view its teams.
3. Go to **Personal Settings** \> **API Access Tokens** and select **New API Access Token**.
4. Enable REST API access and grant the required read scopes. Refer to [Required Permissions](<#required-permissions>).
5. Create the token and copy it immediately. Store it in your secrets tooling.
6. Copy the organization slug from your Buildkite URL, such as `acme-inc` in `https://buildkite.com/acme-inc`.

> [!IMPORTANT]
>
> Each source aggregates one Buildkite organization. The token owner must belong to the organization whose slug you enter in [Connection Settings](<https://documentation.sailpoint.com/connectors/buildkite/saas/help/connecting.html#connection-settings>). To aggregate more organizations, create a source for each one.

For more information, refer to [Managing API Access Tokens](<https://buildkite.com/docs/apis/managing-api-tokens>) in the Buildkite documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Required Permissions

Grant the API access token the following read scopes:

| Scope | API Scope | Description |
| --- | --- | --- |
| Organizations | `read_organizations` | Verifies organization details and lists organization members. |
| Teams | `read_teams` | Lists teams and team members. |
| Clusters | `read_clusters` | Lists clusters and reaches their agent tokens and secrets. |
| Secrets | `read_secrets_details` | Lists metadata for cluster-scoped secrets. Buildkite does not return secret values. |
| Package registries | `read_registries` | Lists package registries and their read tokens. |

Test connection reports missing required scopes by name.