# Integrating SailPoint with Spacelift

Spacelift is a continuous integration and continuous delivery (CI/CD) and infrastructure orchestration platform. It supports Terraform, OpenTofu, Pulumi, CloudFormation, and Kubernetes automation workflows. The Spacelift connector uses a single GraphQL endpoint to aggregate Spacelift objects into SailPoint for governance and certifications.

The connector supports:

- Spacelift managed users as accounts
- Spacelift roles as entitlements
- Spacelift API keys as non-human identities (Credentials)

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

| Feature | Description |
| --- | --- |
| Test connection | Validates reachability of the Spacelift GraphQL endpoint and exchanges the configured API Key ID and API Key Secret for a JSON Web Token (JWT). |
| Account aggregation | Aggregates Spacelift managed users as SailPoint accounts. |
| Account read | Reads a single Spacelift managed user. |
| Entitlement aggregation | Aggregates Spacelift roles as entitlements. |
| Dataset aggregation | Aggregates Spacelift API keys as non-human identities. |

### Non-Human Identity Discovery

- Aggregate Spacelift API keys

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

## Supported Version

- Spacelift SaaS (Cloud)

## Prerequisites

Before you configure the Spacelift source, you need the following:

- A Spacelift account that SailPoint can reach over HTTPS
- Spacelift admin access to create API keys
- A dedicated secret-based Spacelift API key for the integration

## Creating the API Key ID and Secret

The connector uses a secret-based API key. Spacelift supports secret-based and OpenID Connect (OIDC)-based API keys. The connector exchanges the secret-based API Key ID and API Key Secret for a JSON Web Token (JWT).

1. Sign in to your Spacelift account.
2. In the lower-right menu, select your account name, and then select **Organization settings**.
3. In the **Access** section, select **API keys**, and then select **Create API key**.
4. Enter a key name in **Name**. For example: `SailPoint`.
5. For **Type**, select **Secret**.
6. Select **Admin** so the key can read organization-level objects. For more information, refer to [Required Permissions](<#required-permissions>).
7. For **Space**, select the **root** space with the **admin** access level so the key inherits access to every space.
8. (Optional) Set an expiration date. After the key expires, update the source with a new key.
9. Select **Create**. Spacelift generates and downloads a configuration file.
10. Open the downloaded file and copy the `api_key_id` and `api_key_secret` values.
11. Store both values in your secrets tooling. Spacelift does not store the secret, and you cannot retrieve or recreate it later.

The `api_key_id` value is the 26-character ULID of the key. Enter it in **API Key ID**. Enter the `api_key_secret` value in **API Key Secret**.

For vendor steps and screenshots, refer to the Secret-based API keys section of the [Spacelift GraphQL API documentation](<https://docs.spacelift.io/integrations/api>).

## Required Permissions

The connector sends queries to `https://<account>.app.spacelift.io/graphql`. These queries read organization-level objects.

Configure the API key as an **Admin** key with **space admin** access to the **root** space.