Skip to content

Integrating SailPoint with Spacelift

Spacelift is a continuous integration and continuous delivery (CI/CD) and infrastructure orchestration platform. It supports Terraform, OpenTofu, Pulumi, CloudFormation, and Kubernetes automation workflows. The Spacelift connector uses a single GraphQL endpoint to aggregate Spacelift objects into SailPoint for governance and certifications.

The connector supports:

  • Spacelift managed users as accounts
  • Spacelift roles as entitlements
  • Spacelift API keys as non-human identities (Credentials)

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Feature Description
Test connection Validates reachability of the Spacelift GraphQL endpoint and exchanges the configured API Key ID and API Key Secret for a JSON Web Token (JWT).
Account aggregation Aggregates Spacelift managed users as SailPoint accounts.
Account read Reads a single Spacelift managed user.
Entitlement aggregation Aggregates Spacelift roles as entitlements.
Dataset aggregation Aggregates Spacelift API keys as non-human identities.

Non-Human Identity Discovery

  • Aggregate Spacelift API keys

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Supported Version

  • Spacelift SaaS (Cloud)

Prerequisites

Before you configure the Spacelift source, you need the following:

  • A Spacelift account that SailPoint can reach over HTTPS
  • Spacelift admin access to create API keys
  • A dedicated secret-based Spacelift API key for the integration

Creating the API Key ID and Secret

The connector uses a secret-based API key. Spacelift supports secret-based and OpenID Connect (OIDC)-based API keys. The connector exchanges the secret-based API Key ID and API Key Secret for a JSON Web Token (JWT).

  1. Sign in to your Spacelift account.
  2. In the lower-right menu, select your account name, and then select Organization settings.
  3. In the Access section, select API keys, and then select Create API key.
  4. Enter a key name in Name. For example: SailPoint.
  5. For Type, select Secret.
  6. Select Admin so the key can read organization-level objects. For more information, refer to Required Permissions.
  7. For Space, select the root space with the admin access level so the key inherits access to every space.
  8. (Optional) Set an expiration date. After the key expires, update the source with a new key.
  9. Select Create. Spacelift generates and downloads a configuration file.
  10. Open the downloaded file and copy the api_key_id and api_key_secret values.
  11. Store both values in your secrets tooling. Spacelift does not store the secret, and you cannot retrieve or recreate it later.

The api_key_id value is the 26-character ULID of the key. Enter it in API Key ID. Enter the api_key_secret value in API Key Secret.

For vendor steps and screenshots, refer to the Secret-based API keys section of the Spacelift GraphQL API documentation.

Required Permissions

The connector sends queries to https://<account>.app.spacelift.io/graphql. These queries read organization-level objects.

Configure the API key as an Admin key with space admin access to the root space.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.