# Integrating SailPoint with Bytebase

Bytebase is a database DevOps and CI/CD platform that lets organisations manage schema change, query control, data masking, and access governance across many database engines from a single console. This document provides instructions to configure a new direct connection to a Bytebase source. For a reference to the terminology specific to SailPoint products, refer to [Source and Connector Definitions](<https://documentation.sailpoint.com/saas/help/sources/index.html#source-and-connector-definitions>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Bytebase connector supports the following:

### Account Management

- Aggregate Users

> [!IMPORTANT]
>
> Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:
>
> - **Organization Admins**: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
> - **Regular Users**: Limited to 1 manual account or entitlement aggregation per day per source.
>
> These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

## Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

- A Bytebase instance (cloud or self-hosted) and administrative access to its IAM &amp; Admin console for creating service accounts.
- A Bytebase Service Account with sufficient permissions to list users (`bb.users.list`). The credentialed service account must have a workspace-level role authorizing organization-wide user listing - project-scoped service accounts will return restricted results.
- Supported authentication type - **Bytebase Service Account authentication**. The connector exchanges the service account’s email and service key at the Bytebase `/v1/auth/login` endpoint to mint a short-lived access token, then sends that token as a Bearer header on every subsequent API request.
- For more information about service account registration and API token exchange, refer to the [Bytebase Service Account documentation](<https://docs.bytebase.com/administration/service-account>).

## Required Permissions

- A Bytebase Service Account belonging to the target workspace.
- The `bb.users.list` permission granted to that Service Account (typically via the `Workspace DBA` or `Workspace Admin` role).
- The Service Account’s email address and Service Key (the `bbs_*` value shown in the Bytebase Portal when the Service Account is created).
- For more information about service accounts and API usage, refer to the following resources:

  - [Bytebase Service Account documentation](<https://docs.bytebase.com/administration/service-account>)
  - [Codify SQL Review Policies with Bytebase API](<https://docs.bytebase.com/tutorials/api-sql-review-policy>)
  - [Bytebase REST API Reference](<https://api.bytebase.com/#tag/accessgrantservice>)
  - [User and Database Permissions with Bytebase API](<https://docs.bytebase.com/tutorials/api-user-database-permission>)

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.