# Integrating SailPoint with GitLab SaaS

Use the GitLab SaaS source to manage identity and access in the GitLab application. The GitLab SaaS source connects to the GitLab application securely to load data from and provision changes.

This document is designed to give specific information about the requirements and fields needed to successfully configure an instance of the GitLab SaaS source.

The connector supports both [GitLab.com](<https://about.gitlab.com/>) and self-managed GitLab instances, including Dedicated deployments on customer domains.

> [!NOTE]
>
> The GitLab SaaS connector is read-only. It aggregates and reports. It does not create, update, disable or delete anything in GitLab, and it does not manage entitlement assignments. Provisioning is not supported.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The GitLab connector supports the following features:

### Account Management

- Account aggregation of GitLab users
- Membership of groups and projects, with the role held on each, reported as account attributes

### Entitlement Management

- Aggregation of GitLab groups as entitlements
- Aggregation of GitLab projects as entitlements

### Non-Human Identity Discovery

- Aggregation of non-human identities: project, group and personal access tokens, group and project service accounts, and security policy bots
- Derived risk indicators on every token, covering expiry, idleness, rotation age and excessive scope or role

For more information, refer to [Machine Identity Security](<https://documentation.sailpoint.com/saas/help/machine/index.html>).

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Prerequisites

The GitLab SaaS source authenticates with either a personal access token or a group access token. Both tokens are sent in the same request header, so one field holds the type you declare is verified against the token before every operation, and a mismatch is refused.

### Token Scope

The token requires the `read_api` scope. The connector never writes, so no write scope is needed.

### Choosing a Token Type

|  | Personal access token | Group access token |
| --- | --- | --- |
| Reach | Every group and project its owner belongs to | The single group it was issued on, and everything beneath it |
| Target groups | Required on [GitLab.com](<https://about.gitlab.com/>), optional on self-managed | Not used, and rejected if configured |
| Best for | Governing several unrelated groups with one source | Confining a source to one group tree |

On [GitLab.com](<https://about.gitlab.com/>) a personal access token reaches every group its owner belongs to, and those groups may belong to different organizations. Target groups are therefore mandatory for that combination, so that aggregation cannot pull another organization's users into your tenant. A self-managed instance holds one organization, so the list is optional there.

> [!NOTE]
>
> A project access token is not supported as a source credential and is refused.

### Roles the Token Needs

What the token can see determines what the source reports. A missing role does not fail the aggregation. GitLab refuses that one listing, and the source skips it. An under-privileged token yields a partial result rather than an error.

| To aggregate | The token needs |
| --- | --- |
| Users, groups and projects in a group tree | At least Reporter on the groups concerned |
| A group's access tokens and its service accounts | Owner on that group |
| A project's access tokens | Maintainer or Owner on that project |
| Instance administrator, self-managed only | Instance administrator, self-managed only |
| Every personal access token on the instance | Instance administrator, self-managed only |

### GitLab Tier

Service accounts and the group credentials inventory are GitLab Premium and Ultimate features. On Free, those datasets return no rows. Accounts, entitlements and access tokens are unaffected.