Skip to content

Integrating SailPoint with FOSSA

FOSSA is a software composition analysis platform that helps organizations manage open-source licensing, security, and policy across their projects. Teams use FOSSA to inventory dependencies, assign organization roles, and group users into teams that control access to projects. This document provides the instructions required to configure a new direct connection between SailPoint and FOSSA for Quick Compliance use cases. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The FOSSA connector supports the following:

Account Management

  • Aggregate Users

Entitlement Management

  • Aggregate Roles
  • Aggregate Teams

Note

This connector is read-only. It supports test connection, account aggregation, and entitlement aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported in this release.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before you configure the FOSSA connector, ensure the following requirements are met:

  1. Sign in to FOSSA with an account that can create API tokens (Account Settings > Integrations > API). Creating a Full access token requires permission to manage API tokens.
  2. Create a Full API token. Push-only tokens cannot read users, roles, or teams and will fail test connection and aggregation.
  3. Copy and securely store the token. FOSSA shows the token value only at creation time.
  4. Record the following values for connector configuration:
    • Base URL
    • API Token

Note

  • The connector sends the token on every request as Authorization: Bearer <API Token>.
  • Use a Full token. A Push-only token is for CLI or CI analysis push only and cannot call user, role, or team APIs.
  • The token has the same privileges as the FOSSA account (or service account) that created it. Use an account that can list organization users, organization-scoped roles, and teams.
  • For automation, FOSSA recommends a service account with a Full token rather than a personal user token. Service accounts appear in the user list with isServiceAccount set to true.

Required Permissions

A user or service account with permission to manage API tokens can create a Full token under Account Settings > Integrations > API. Organization admins typically have this permission.

Access is governed by the FOSSA account behind the token:

  • The account must be able to list users (GET /v2/users), read a user (GET /users/{id}), list roles (GET /roles), and list teams (GET /v2/teams).
  • If the token belongs to a user with no organization role and limited team access, aggregation can return a subset of users, roles, or teams, or fail with 403.
  • Organization-scoped roles (Admin, Editor, Viewer, and custom organization roles) are aggregated. Team-scoped roles are not aggregated as Role entitlements.

For more information about FOSSA, refer to the following:

Note

The linked document is not maintained by SailPoint and is subject to change without notice.