Integrations
Integration scans, discovery, and import operations.
Scan Vault for importable credentials
Scan Vault for importable credentials
List available Vault mounts
List available Vault mounts
Import selected Vault findings as tokens
Import selected Vault findings as tokens
Scan GitLab credentials and expirations
Scan GitLab credentials and expirations
Scan GitHub credentials and expirations
Scan GitHub credentials and expirations
Detect AWS regions from credentials
Detect AWS regions from credentials
Scan AWS resources for token-like credentials
Scan AWS resources for token-like credentials
Scan Azure resources for credentials and expirations
Accepts a pasted access token or `authMethod: client_credentials` (tenant ID, client ID, client secret). Commercial Azure only (`login.microsoftonline.com`, `vault.azure.net`); national clouds are not supported. Key Vault inventory lists metadata, so Key Vault Reader is enough. This is not CertOps Azure DNS. OpenID discovery is used only for Graph (Entra) scans, not Key Vault.
Scan GCP Secret Manager, Certificate Manager, and Compute Engine SSL certificates
Lists Secret Manager secrets when `include.secrets` is true (the default) and, when `include.certificates` is true, Certificate Manager certificates at `locations/global` plus Compute Engine `sslCertificates` (global and every reachable region). Paste a short-lived `gcloud auth print-access-token` value, not a service-account JSON key. Roles on a service account apply only if that account is impersonated. A failed sub-scan names the Google reason (API not enabled, missing permission, or wrong identity) instead of a bare HTTP 403. Incomplete certificate kinds are reported incomplete so obsolete-item cleanup cannot delete tokens the scan never fully enumerated.
Scan Azure AD apps and credentials
Accepts a pasted access token or `authMethod: client_credentials` (tenant ID, client ID, client secret). Commercial Azure only (`login.microsoftonline.com`, `graph.microsoft.com`); national clouds are not supported. Graph inventory recommends Application.Read.All. This is not CertOps Azure DNS. OpenID discovery is used only for Graph, to canonicalize the tenant GUID before minting.
Check duplicate candidates before import
Check duplicate candidates before import
Generic import endpoint for integration findings
Generic import endpoint for integration findings