> ## Documentation Index > Fetch the complete documentation index at: https://help.dsalta.com/llms.txt > Use this file to discover all available pages before exploring further. # Descope > Customer identity platform — console team, keys & access Connect Descope with a Project ID and a company-level management key to sync the console team with their roles and status, projects, tenants, access keys and roles, and the audit trail, and run access reviews. Read-only. Data feeds into your Access accounts, Inventory and Changes pages. **Read-only access.** DSALTA only reads data from this integration. It never creates, modifies, or deletes anything in your environment, and every remediation step is performed by your team directly in the third-party product. **What you'll see.** The Access page lists the **console team** of your one Descope **company** — the people who sign in to the Descope console — never the end users of your projects. Each row shows the member's display name (or their email address when Descope reports none), their email, and their role: **Company Admin** for a company administrator, otherwise their project and tag roles (for example **Admin**, **Developer**, **Support** or **Auditor**), or **Member** when Descope reports none. Members whose status reads invited or pending are left out. A member whose account the company has disabled is shown as **Inactive**; everyone else is shown as **Active**, and each row is stamped with the date of the sync. Descope reports no per-user MFA state, so the **MFA** column is blank (shown as a dash). DSALTA collects this integration's data when you connect it — you can refresh it at any time with **Sync from integrations** on the **Integrations** page. The compliance checks below re-run once a day at 02:00 America/New\_York. ## What DSALTA reads DSALTA reads the Descope console team roster — names, emails, roles and status — which appears on your **Access** page; your Descope **projects** (environment and tag), **tenants** (self-provisioning domain count and creation date), **access keys** (name, roles, status, expiry, creator and description — never the key itself) and **roles** (tenant, permission count and description), which appear on your **Inventory** page; and the company's **audit trail**, which appears on your **Changes** page. Each audit event arrives as a change that has already happened — status **Deployed**, the action and the actor's email in the title, the method, device, location and IP address in the description (the event's request details are dropped when fetched), priority **Medium** when the action name mentions a deletion, key, permission, role, password or removal and **Low** otherwise, and the project the event belongs to as the environment (or **Descope company** when it belongs to none). The audit trail is read with a single search per sync, up to 1,000 events, with no date window. Tenants appear once you have created one, and access keys once one exists. The projects' end users, their sign-in history and their trusted devices are never read. It calls these Descope management endpoints on `api.descope.com` (or on the regional `api..descope.com` host that a Project ID of 32 or more characters selects): * `POST /v1/mgmt/descoper/list` * `POST /v1/mgmt/projects/list` * `GET /v1/mgmt/tenant/all` * `POST /v1/mgmt/accesskey/search` * `GET /v1/mgmt/role/all` * `POST /v1/mgmt/audit/search` Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Descope environment. ## Troubleshooting The Project ID or the management key is wrong, or the key cannot list the console team. The key needs **Company level access** with the **Descopers - Read & Write** role: a key created with **Descoper Level access (SCIM)** or pinned to specific projects is refused on the team list, and DSALTA treats an empty team list as a rejected connection. A Project ID of 32 or more characters sends every request to the regional Descope host it encodes, so a mistyped ID can also point DSALTA at the wrong host. A management key created with an expiration of 30, 60 or 90 days stops the sync silently on that day. Create a new key with **Expiration** set to **never**, then disconnect and connect again. Note that disconnecting permanently deletes the data already collected from Descope. Projects, tenants, access keys, roles and audit events are read best-effort after the team roster: a failure on any of those calls leaves that part of the page empty without failing the sync. A fresh company has one project and the built-in **Tenant Admin** role, tenants appear once you create one, and the audit trail is read with one search per sync because Descope limits audit searches to 10 per minute. Click **Sync from integrations** on the **Integrations** page to retry. Open **Integrations** in the DSALTA sidebar, stay on the **Connected** tab, and click **Manage** on the integration's card. Open the **Status** tab: it shows either **Connected and working properly** or **Connection issues detected**. Use the **Status** tab, not **Overview** — Overview always reports **Connected** regardless of the real state. On an integration-powered check, **Failed** normally means DSALTA was blocked rather than that you are non-compliant. Open the test, go to **Source Data**, and read the result code: **403** is a missing permission, **428** is a setting DSALTA still needs, **500** is a failure on DSALTA's side. A real compliance gap shows **207** and leaves the test looking **Completed**. See [Understanding Test Results](/guides/compliance/test-results). Compliance checks re-run once a day at 02:00 America/New\_York. To refresh sooner, open **Integrations → Connected** and click **Sync from integrations** at the top right — it refreshes every connected integration at once. There is no Reconnect, Repair or Refresh Token button. The only repair available is to disconnect and connect again. **Disconnecting is destructive and cannot be undone.** DSALTA removes the access records, inventory, vulnerabilities, code changes, incidents and device records collected from this integration, and deletes the test results tied to the connection. Export anything you still need as audit evidence first — see [Integration errors](/troubleshooting/integration-errors). That is expected. **Configure scope** is read-only — it shows what DSALTA is permitted to read, and has no Save action. To change what DSALTA can see, change the permissions on the credential in the third-party product, then disconnect and connect again. A Descope Project ID together with a company-level management key. Projects and tenants are detected automatically. Read-only calls only. **Before you begin** * A Descope company administrator — management keys are created under **Company → Management Keys**. You will need: | Field | Where to find it | Example | | - | - | - | | **Project ID** | Console project switcher → **Project → Project ID** | `P…` | | **Management key** | **Company → Management Keys** (`app.descope.com/settings/company/managementkeys`) | `K…`, shown once | Open **Integrations** in the DSALTA sidebar, find **Descope**, and click **Connect** to open the connect panel. In the [Descope console](https://app.descope.com), open the project switcher and copy the Project ID (**Project → Project ID**). It is half of the credential, and it also decides the regional API host. Open **Company → Management Keys** ([app.descope.com/settings/company/managementkeys](https://app.descope.com/settings/company/managementkeys)) and create a key: name it, set **Expiration** to **never** — an expiring key stops the sync silently — choose **Company level access**, and grant **Descopers - Read & Write**, **Asset Management - Read Only** and **Audit**. Leave **Permitted IPs** empty and do not pin the key to specific projects: the project association cannot be changed later. **Do not choose Descoper Level access (SCIM).** That scope covers SCIM operations only and cannot read the team; DSALTA rejects such a key at connect time. Descope offers no read-only Descopers role, so the key that reads the team can also modify it. DSALTA only ever reads. The key is shown once — if it is lost, create a new one. Return to the connect panel, paste the Project ID and the management key, and click **Connect**. DSALTA validates the pair when you click **Connect**, by listing your company's console team with it — Descope has no separate identity call for management keys — and rejects a key that returns no team members. On success the integration moves to the **Connected** tab, and **Manage → Status** reads **Connected and working properly**. Checks begin reporting after the first sync. **If the connection is rejected.** A wrong Project ID or management key, an expired key, or a key without company-level Descopers access — a SCIM-scoped or project-limited key cannot list the team. The on-screen message is generic — see [Connection error messages](/troubleshooting/connection-error-messages). Each check below re-runs once a day, at 02:00 America/New\_York, while this integration is connected. Click any check for step-by-step remediation guidance. | Check | Severity | What it verifies | | - | - | - | | [User access to Critical System should be valid](/integrations/descope/user-access-to-critical-system-should-be-valid) | Info | Checks that everyone with Descope console access is an active employee on the People page. | | [Offboarded users should not have active access](/integrations/descope/offboarded-users-should-not-have-active-access) | High | Checks that offboarded employees no longer have active Descope console access. | | Topic | Link | | - | - | | Setup | [Descope management keys](https://docs.descope.com/management) | | Remediation | [Company settings](https://docs.descope.com/management/company-settings) | | General | [Descope console](https://app.descope.com) | | DSALTA | [Connection error messages](/troubleshooting/connection-error-messages) |