> ## Documentation Index > Fetch the complete documentation index at: https://help.dsalta.com/llms.txt > Use this file to discover all available pages before exploring further. # Infisical > Secrets management — members & access Connect Infisical with a machine identity's Client ID and Client Secret (Universal Auth) to sync organization members and projects, and run access reviews. Read-only. **Read-only access.** DSALTA only reads data from this integration. It never creates, modifies, or deletes anything in your environment, and every remediation step is performed by your team directly in the third-party product. **What you'll see.** The Access page lists the **members** of the Infisical organization the machine identity belongs to, with their name, email and organization role, and respects Infisical's own active flag — a member Infisical reports as inactive is shown as **Inactive**. Pending invitations are left out. Infisical reports no join date or MFA state on this endpoint, so the **MFA** column shows **Unknown** and each row is stamped with the date of the sync. Machine identities themselves are not listed. DSALTA collects this integration's data when you connect it — you can refresh it at any time with **Sync from integrations** on the **Integrations** page. The compliance checks below re-run once a day at 02:00 America/New\_York. ## What DSALTA reads DSALTA reads the Infisical organization membership roster — names, emails, roles and active state — which appears on your **Access** page; and the organization's **projects**, which appear on your **Inventory** page by name and slug. Secrets are never read. It calls these Infisical endpoints on `app.infisical.com`: * `/api/v1/auth/universal-auth/login` (exchanges the Client ID and Secret for an access token) * `/api/v2/organizations/{orgId}/memberships` * `/api/v2/organizations/{orgId}/workspaces` Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Infisical environment. The organization is taken from the access token Infisical issues to the identity; there is nothing to select. ## Troubleshooting Each Universal Auth login consumes one use of the client secret. DSALTA caches the access token and re-logs in only when it expires, but a client secret created with a capped **Max Number of Uses** eventually returns *Access denied due to client secret usage limit reached*. Create a new client secret with **Max Number of Uses** set to **0** (unlimited), then disconnect and connect again. Note that disconnecting permanently deletes the data already collected from Infisical. Wrong Client ID or Client Secret, a revoked secret, or an identity whose organization role cannot read members. Give the identity a role that can read members, create a fresh secret, and connect again. Open **Integrations** in the DSALTA sidebar, stay on the **Connected** tab, and click **Manage** on the integration's card. Open the **Status** tab: it shows either **Connected and working properly** or **Connection issues detected**. Use the **Status** tab, not **Overview** — Overview always reports **Connected** regardless of the real state. On an integration-powered check, **Failed** normally means DSALTA was blocked rather than that you are non-compliant. Open the test, go to **Source Data**, and read the result code: **403** is a missing permission, **428** is a setting DSALTA still needs, **500** is a failure on DSALTA's side. A real compliance gap shows **207** and leaves the test looking **Completed**. See [Understanding Test Results](/guides/compliance/test-results). Compliance checks re-run once a day at 02:00 America/New\_York. To refresh sooner, open **Integrations → Connected** and click **Sync from integrations** at the top right — it refreshes every connected integration at once. There is no Reconnect, Repair or Refresh Token button. The only repair available is to disconnect and connect again. **Disconnecting is destructive and cannot be undone.** DSALTA removes the access records, inventory, vulnerabilities, code changes, incidents and device records collected from this integration, and deletes the test results tied to the connection. Export anything you still need as audit evidence first — see [Integration errors](/troubleshooting/integration-errors). That is expected. **Configure scope** is read-only — it shows what DSALTA is permitted to read, and has no Save action. To change what DSALTA can see, change the permissions on the credential in the third-party product, then disconnect and connect again. An Infisical machine-identity Client ID and Client Secret (Universal Auth). Read-only. **Before you begin** * An Infisical organization and **Admin** access to it, to create machine identities. * This integration talks to Infisical Cloud at `app.infisical.com`; a self-hosted Infisical instance cannot be connected. You will need: | Field | Where to find it | Example | | ----------------- | ------------------------------------------ | --------------------- | | **Client ID** | The identity's **Universal Auth** settings | Shown on the identity | | **Client Secret** | **Universal Auth → Add Client Secret** | Shown at creation | Open **Integrations** in the DSALTA sidebar, find **Infisical**, and click **Connect** to open the connect panel. In Infisical, open **Organization Settings → Access Control → Identities** and click **Create identity**. Give it a name and an organization role that can read members — the built-in **Member** role can read the organization; **Admin** is more than DSALTA needs. Open the identity, choose **Universal Auth**, and click **Add Client Secret**. Copy the **Client ID** and the new **Client Secret**. **Set "Max Number of Uses" to 0 (unlimited).** Every login consumes one use of the secret. A capped secret stops working mid-life with the error *Access denied due to client secret usage limit reached*, and the connection breaks after a number of syncs. Leave **TTL** at 0 as well unless you plan to rotate the secret on that schedule. Return to the connect panel, paste the Client ID and the Client Secret into their fields, and click **Connect**. DSALTA validates the pair when you click **Connect**, by logging in through Universal Auth and listing the organization's members. On success the integration moves to the **Connected** tab, and **Manage → Status** reads **Connected and working properly**. Checks begin reporting after the first sync. **If the connection is rejected.** Wrong Client ID or Client Secret, an identity whose role cannot read members, or a secret that has hit its **Max Number of Uses**. The on-screen message is generic — see [Connection error messages](/troubleshooting/connection-error-messages). Each check below re-runs once a day, at 02:00 America/New\_York, while this integration is connected. Click any check for step-by-step remediation guidance. | Check | Severity | What it verifies | | ------------------------------------------------------------------------------------------------------------------------ | -------- | ------------------------------------------------------------------------------------ | | [User access to Critical System should be valid](/integrations/infisical/user-access-to-critical-system-should-be-valid) | Info | Checks that everyone with Infisical access is an active employee on the People page. | | [Offboarded users should not have active access](/integrations/infisical/offboarded-users-should-not-have-active-access) | High | Checks that offboarded employees no longer have active Infisical access. | | Topic | Link | | ----------- | -------------------------------------------------------------------------------------------------------------------- | | Setup | [Universal Auth for machine identities](https://infisical.com/docs/documentation/platform/identities/universal-auth) | | Remediation | [Organization roles](https://infisical.com/docs/documentation/platform/access-controls/role-based-access-controls) | | General | [Infisical](https://app.infisical.com) | | DSALTA | [Connection error messages](/troubleshooting/connection-error-messages) |