Integrating SailPoint with Bytebase

Bytebase is a database DevOps and CI/CD platform that lets organisations manage schema change, query control, data masking, and access governance across many database engines from a single console. This document provides instructions to configure a new direct connection to a Bytebase source. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Bytebase connector supports the following:

Account Management

Aggregate Users

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

A Bytebase instance (cloud or self-hosted) and administrative access to its IAM & Admin console for creating service accounts.
A Bytebase Service Account with sufficient permissions to list users (bb.users.list). The credentialed service account must have a workspace-level role authorizing organization-wide user listing - project-scoped service accounts will return restricted results.
Supported authentication type - Bytebase Service Account authentication. The connector exchanges the service account’s email and service key at the Bytebase /v1/auth/login endpoint to mint a short-lived access token, then sends that token as a Bearer header on every subsequent API request.
For more information about service account registration and API token exchange, refer to the Bytebase Service Account documentation.

Required Permissions

A Bytebase Service Account belonging to the target workspace.
The bb.users.list permission granted to that Service Account (typically via the Workspace DBA or Workspace Admin role).
The Service Account’s email address and Service Key (the bbs_* value shown in the Bytebase Portal when the Service Account is created).
For more information about service accounts and API usage, refer to the following resources:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.