Heroku

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Heroku using read-only API access to collect compliance evidence automatically. Data feeds into your Access accounts and Inventory pages.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Heroku environment.

DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.

What DSALTA reads

DSALTA reads the Heroku user roster — email addresses, roles and two-factor status, which appears on your Access page; and your Heroku resources, which appear on your Inventory page. Heroku’s member API returns no display name and no account state, so each row is labelled with its email address and listed as Active.It calls these Heroku endpoints:

/account
/apps
/apps/{appId}/collaborators
/teams
/teams/{teamId}/members
/enterprise-accounts
/enterprise-accounts/{accountId}/members

Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Heroku environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Heroku card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Heroku. This usually happens when API tokens expire.

Data is not syncing

Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

Create a Heroku API token from your account settings and paste it below to connect.Before you begin

Heroku account (a Team to review team members)
A Heroku user account that is not SSO-enabled. If the account you generate the token from uses Heroku SSO, the token expires 8 hours after login and the DSALTA connection will break the same day — Heroku’s own guidance for Enterprise Accounts and Teams with SSO is to keep one non-SSO user for long-lived integration tokens.

You will need:

Field	Where to find it	Example
Heroku API Token	Create one at Heroku → Account settings → Applications → Authorizations → Create authorization. · Open	`HRKU-AALJCYR7SRzPkj9_BGqhi1jAI1J5P4WfD6ITENvdVydAPCnNcAlrMMahHrTo`

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Heroku, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Integrating Heroku with DSALTA means

DSALTA will only be able to read your Heroku team members, collaborators, and 2FA status (access reviews) and your Heroku apps (inventory) for security compliance.DSALTA uses read-only access and never modifies your Heroku apps, teams, or resources.

Create a Heroku API token

Click your avatar (top-right) and choose Account settings.
Open the Applications tab.
Under Authorizations, click Create authorization.
Enter a Description (for example DSALTA access review), leave Expiration blank for a long-lived token, then click Create.
Copy the Authorization Token that appears — you’ll paste it in the next step.

Prefer the Authorizations token above over the account API Key, which rotates whenever your password changes.

Current Heroku authorization tokens begin with HRKU- (for example HRKU-AALJCYR7SRzPkj9_BGqhi1jAI1J5P4WfD6ITENvdVydAPCnNcAlrMMahHrTo). If what you copied looks like that, it is the right value — the UUID-style example shown in the connect panel is out of date.

The page you land on is titled Manage Account and has three tabs — Account, Applications, Billing. Authorizations is the second section of the Applications tab, below Third-party Services; the Create authorization button sits under the Registered Authorizations list.

Heroku Manage Account with the Applications tab selected and the Create authorization button under Authorizations

Enter your API token

Paste the Authorization Token you copied and click Connect.API Token — Example: 01234567-89ab-cdef-0123-456789abcdef

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Invalid API token or insufficient permissions.The on-screen message is generic — see Connection error messages.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
User access to Critical System should be valid	Info	Checks that users with access to critical systems are authorized in Heroku.
MFA (two-factor authentication) should be enabled for all members	Info	Checks that two-factor authentication is enabled for all Heroku team members.
Offboarded users should not have active access	Info	Checks that offboarded employees no longer retain active Heroku access.

Topic	Link
Setup	Heroku Platform API — Authentication
Setup	Heroku — How should I generate an API key for the Platform API?
General	Heroku website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting