How DSALTA integrates with Heroku — data collected, setup guide, and automated compliance checks.
Overview
How to connect
Automated checks
Useful links
DSALTA connects to Heroku using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules.
Read-only access. DSALTA never modifies, creates, or deletes resources in your Heroku environment.
DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.
DSALTA reads the Heroku user roster — email addresses, roles and two-factor status, which appears on your Access page; and your Heroku resources, which appear on your Inventory page. Heroku’s member API returns no display name and no account state, so each row is labelled with its email address and listed as Active.It calls these Heroku endpoints:
/account
/apps
/apps/{appId}/collaborators
/teams
/teams/{teamId}/members
/enterprise-accounts
/enterprise-accounts/{accountId}/members
Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Heroku environment.
There is no Reconnect button. Open Integrations → Connected, click Manage on the Heroku card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Heroku. This usually happens when API tokens expire.
Data is not syncing
Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.
Create a Heroku API token from your account settings and paste it below to connect.Before you begin
Heroku account (a Team to review team members)
A Heroku user account that is not SSO-enabled. If the account you generate the token from uses Heroku SSO, the token expires 8 hours after login and the DSALTA connection will break the same day — Heroku’s own guidance for Enterprise Accounts and Teams with SSO is to keep one non-SSO user for long-lived integration tokens.
You will need:
Field
Where to find it
Example
Heroku API Token
Create one at Heroku → Account settings → Applications → Authorizations → Create authorization. · Open
Open Integrations in the DSALTA sidebar, find Heroku, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.
2
Integrating Heroku with DSALTA means
DSALTA will only be able to read your Heroku team members, collaborators, and 2FA status (access reviews) and your Heroku apps (inventory) for security compliance.DSALTA uses read-only access and never modifies your Heroku apps, teams, or resources.
3
Create a Heroku API token
Sign in to the Heroku Dashboard, then follow these steps:
Click your avatar (top-right) and choose Account settings.
Open the Applications tab.
Under Authorizations, click Create authorization.
Enter a Description (for example DSALTA access review), leave Expiration blank for a long-lived token, then click Create.
Copy the Authorization Token that appears — you’ll paste it in the next step.
Prefer the Authorizations token above over the account API Key, which rotates whenever your password changes.
Current Heroku authorization tokens begin with HRKU- (for example HRKU-AALJCYR7SRzPkj9_BGqhi1jAI1J5P4WfD6ITENvdVydAPCnNcAlrMMahHrTo). If what you copied looks like that, it is the right value — the UUID-style example shown in the connect panel is out of date.
The page you land on is titled Manage Account and has three tabs — Account, Applications, Billing. Authorizations is the second section of the Applications tab, below Third-party Services; the Create authorization button sits under the Registered Authorizations list.
4
Enter your API token
Paste the Authorization Token you copied and click Connect.API Token — Example: 01234567-89ab-cdef-0123-456789abcdef
DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.
If the connection is rejected. Invalid API token or insufficient permissions.The on-screen message is generic — see Connection error messages.
Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.
.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)
