Skip to main content
Connect Descope with a Project ID and a company-level management key to sync the console team with their roles and status, projects, tenants, access keys and roles, and the audit trail, and run access reviews. Read-only. Data feeds into your Access accounts, Inventory and Changes pages.
Read-only access. DSALTA only reads data from this integration. It never creates, modifies, or deletes anything in your environment, and every remediation step is performed by your team directly in the third-party product.
What you’ll see. The Access page lists the console team of your one Descope company — the people who sign in to the Descope console — never the end users of your projects. Each row shows the member’s display name (or their email address when Descope reports none), their email, and their role: Company Admin for a company administrator, otherwise their project and tag roles (for example Admin, Developer, Support or Auditor), or Member when Descope reports none. Members whose status reads invited or pending are left out. A member whose account the company has disabled is shown as Inactive; everyone else is shown as Active, and each row is stamped with the date of the sync. Descope reports no per-user MFA state, so the MFA column is blank (shown as a dash).
DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.

​
What DSALTA reads

DSALTA reads the Descope console team roster — names, emails, roles and status — which appears on your Access page; your Descope projects (environment and tag), tenants (self-provisioning domain count and creation date), access keys (name, roles, status, expiry, creator and description — never the key itself) and roles (tenant, permission count and description), which appear on your Inventory page; and the company’s audit trail, which appears on your Changes page. Each audit event arrives as a change that has already happened — status Deployed, the action and the actor’s email in the title, the method, device, location and IP address in the description (the event’s request details are dropped when fetched), priority Medium when the action name mentions a deletion, key, permission, role, password or removal and Low otherwise, and the project the event belongs to as the environment (or Descope company when it belongs to none). The audit trail is read with a single search per sync, up to 1,000 events, with no date window. Tenants appear once you have created one, and access keys once one exists. The projects’ end users, their sign-in history and their trusted devices are never read.It calls these Descope management endpoints on api.descope.com (or on the regional api.<region>.descope.com host that a Project ID of 32 or more characters selects):
  • POST /v1/mgmt/descoper/list
  • POST /v1/mgmt/projects/list
  • GET /v1/mgmt/tenant/all
  • POST /v1/mgmt/accesskey/search
  • GET /v1/mgmt/role/all
  • POST /v1/mgmt/audit/search
Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Descope environment.

​
Troubleshooting

The Project ID or the management key is wrong, or the key cannot list the console team. The key needs Company level access with the Descopers - Read & Write role: a key created with Descoper Level access (SCIM) or pinned to specific projects is refused on the team list, and DSALTA treats an empty team list as a rejected connection. A Project ID of 32 or more characters sends every request to the regional Descope host it encodes, so a mistyped ID can also point DSALTA at the wrong host.
A management key created with an expiration of 30, 60 or 90 days stops the sync silently on that day. Create a new key with Expiration set to never, then disconnect and connect again. Note that disconnecting permanently deletes the data already collected from Descope.
Projects, tenants, access keys, roles and audit events are read best-effort after the team roster: a failure on any of those calls leaves that part of the page empty without failing the sync. A fresh company has one project and the built-in Tenant Admin role, tenants appear once you create one, and the audit trail is read with one search per sync because Descope limits audit searches to 10 per minute. Click Sync from integrations on the Integrations page to retry.
Open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Manage on the integration’s card. Open the Status tab: it shows either Connected and working properly or Connection issues detected.Use the Status tab, not Overview — Overview always reports Connected regardless of the real state.
On an integration-powered check, Failed normally means DSALTA was blocked rather than that you are non-compliant. Open the test, go to Source Data, and read the result code: 403 is a missing permission, 428 is a setting DSALTA still needs, 500 is a failure on DSALTA’s side.A real compliance gap shows 207 and leaves the test looking Completed. See Understanding Test Results.
Compliance checks re-run once a day at 02:00 America/New_York. To refresh sooner, open Integrations → Connected and click Sync from integrations at the top right — it refreshes every connected integration at once.
There is no Reconnect, Repair or Refresh Token button. The only repair available is to disconnect and connect again.
Disconnecting is destructive and cannot be undone. DSALTA removes the access records, inventory, vulnerabilities, code changes, incidents and device records collected from this integration, and deletes the test results tied to the connection. Export anything you still need as audit evidence first — see Integration errors.
That is expected. Configure scope is read-only — it shows what DSALTA is permitted to read, and has no Save action. To change what DSALTA can see, change the permissions on the credential in the third-party product, then disconnect and connect again.