> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Spacelift

> Infrastructure-as-code platform — users & access

<Tabs>
  <Tab title="Overview">
    Connect Spacelift with your tenant URL and an API key granted the Space admin role to sync managed users and stacks, and run access reviews. Read-only.

    <Info>
      **Read-only access.** DSALTA only reads data from this integration. It never creates, modifies, or deletes anything in your environment, and every remediation step is performed by your team directly in the third-party product.
    </Info>

    <Info>
      **What you'll see.** The Access page lists the **managed users** of your Spacelift account whose status is active, with their username and role; users who are still invited or otherwise not active are left out. Spacelift's managed-user record carries no separate email field, so the username is used as the identity — where your identity provider issues email-shaped usernames, matching to the People page works by email; otherwise DSALTA falls back to matching the username. Spacelift reports no join date or MFA state, so the **MFA** column shows **Unknown** and each row is stamped with the date of the sync.
    </Info>

    <Note>
      **The API key needs the Space admin role.** Without it the key exchanges for a token normally, but listing users returns *unauthorized* and the connection is rejected.
    </Note>

    <Note>
      DSALTA collects this integration's data when you connect it — you can refresh it at any time with **Sync from integrations** on the **Integrations** page. The compliance checks below re-run once a day at 02:00 America/New\_York.
    </Note>

    ## What DSALTA reads

    DSALTA reads the Spacelift managed-user roster — usernames and roles of active users — which appears on your **Access** page; and your Spacelift **stacks**, which appear on your **Inventory** page with their state and whether they are administrative.

    It sends these GraphQL operations to `https://<tenant>/graphql`:

    * `mutation { apiKeyUser(id, secret) { jwt } }` — exchanges the key for a short-lived token
    * `query { managedUsers { … } }`
    * `query { stacks { … } }`

    Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Spacelift environment.

    ## Troubleshooting

    <AccordionGroup>
      <Accordion title="The connection is rejected">
        Check three things: the **Tenant URL** must be your full address including the region (`https://<name>.app.spacelift.io` or `https://<name>.app.us.spacelift.io`), the key ID and secret must be the pair from the downloaded config file, and the key must hold the **Space admin** role. A key without that role logs in and then fails with *unauthorized* when DSALTA lists users.
      </Accordion>

      <Accordion title="A user is missing from the Access page">
        Only managed users whose status is **active** are synced. A user whose invitation is still pending, or who was deactivated, does not appear.
      </Accordion>
    </AccordionGroup>

    <AccordionGroup>
      <Accordion title="How do I check whether the connection is healthy?">
        Open **Integrations** in the DSALTA sidebar, stay on the **Connected** tab, and click **Manage** on the integration's card. Open the **Status** tab: it shows either **Connected and working properly** or **Connection issues detected**.

        Use the **Status** tab, not **Overview** — Overview always reports **Connected** regardless of the real state.
      </Accordion>

      <Accordion title="A check shows Failed and nothing changed on my side">
        On an integration-powered check, **Failed** normally means DSALTA was blocked rather than that you are non-compliant. Open the test, go to **Source Data**, and read the result code: **403** is a missing permission, **428** is a setting DSALTA still needs, **500** is a failure on DSALTA's side.

        A real compliance gap shows **207** and leaves the test looking **Completed**. See [Understanding Test Results](/guides/compliance/test-results).
      </Accordion>

      <Accordion title="Data looks out of date">
        Compliance checks re-run once a day at 02:00 America/New\_York. To refresh sooner, open **Integrations → Connected** and click **Sync from integrations** at the top right — it refreshes every connected integration at once.
      </Accordion>

      <Accordion title="How do I repair a broken connection?">
        There is no Reconnect, Repair or Refresh Token button. The only repair available is to disconnect and connect again.

        <Warning>
          **Disconnecting is destructive and cannot be undone.** DSALTA removes the access records, inventory, vulnerabilities, code changes, incidents and device records collected from this integration, and deletes the test results tied to the connection. Export anything you still need as audit evidence first — see [Integration errors](/troubleshooting/integration-errors).
        </Warning>
      </Accordion>

      <Accordion title="Configure scope will not let me change anything">
        That is expected. **Configure scope** is read-only — it shows what DSALTA is permitted to read, and has no Save action. To change what DSALTA can see, change the permissions on the credential in the third-party product, then disconnect and connect again.
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="How to connect">
    Your full Spacelift tenant URL plus an API key (id + secret) granted the Space admin role. Read-only.

    **Before you begin**

    * A Spacelift account and access to **Organization settings**, which is where API keys are created.
    * Your full tenant URL from the browser address bar — it is `<name>.app.spacelift.io` or `<name>.app.us.spacelift.io` depending on region.

    You will need:

    | Field              | Where to find it                                    | Example                         |
    | ------------------ | --------------------------------------------------- | ------------------------------- |
    | **Tenant URL**     | Your browser address bar                            | `https://acme.app.spacelift.io` |
    | **API key ID**     | The config file Spacelift downloads at key creation | `api_key_id`                    |
    | **API key secret** | The same file                                       | `api_key_secret`                |

    <Steps>
      <Step title="Start in DSALTA">
        Open **Integrations** in the DSALTA sidebar, find **Spacelift**, and click **Connect** to open the connect panel.
      </Step>

      <Step title="Create an API key">
        In Spacelift, click your account name in the lower left, choose **Organization settings**, open **API keys** under Access, and click **Create API key**. Name the key and set **Type** to **Secret**. Spacelift downloads a config file containing `api_key_id` and `api_key_secret` — keep it, because Spacelift does not retain the secret and cannot regenerate it.
      </Step>

      <Step title="Grant the key the Space admin role">
        In the key's **Space** settings, assign it the **Space admin** role. This is a space-role assignment, not an admin toggle: a key without it logs in fine but user listing returns *unauthorized*, and the connection is rejected.

        <Warning>
          Space admin is the minimum that can read the user list, and it also lets the key manage that space. DSALTA never writes, but the key itself is not read-only — keep it in DSALTA only.
        </Warning>
      </Step>

      <Step title="Find your tenant URL">
        Copy your full Spacelift address from the browser address bar, region included — `https://<name>.app.spacelift.io` or `https://<name>.app.us.spacelift.io`. DSALTA adds `https://` if you leave it off and strips a trailing `/graphql`.
      </Step>

      <Step title="Connect Spacelift">
        Return to the connect panel, paste the tenant URL, the API key ID and the API key secret, and click **Connect**.
      </Step>
    </Steps>

    <Check>
      DSALTA validates the credentials when you click **Connect**, by exchanging the key for a token and listing managed users. On success the integration moves to the **Connected** tab, and **Manage → Status** reads **Connected and working properly**. Checks begin reporting after the first sync.
    </Check>

    <Warning>
      **If the connection is rejected.** Wrong tenant URL or region, wrong key ID or secret, or a key without the Space admin role.

      The on-screen message is generic — see [Connection error messages](/troubleshooting/connection-error-messages).
    </Warning>
  </Tab>

  <Tab title="Automated checks">
    Each check below re-runs once a day, at 02:00 America/New\_York, while this integration is connected. Click any check for step-by-step remediation guidance.

    | Check                                                                                                                    | Severity | What it verifies                                                                     |
    | ------------------------------------------------------------------------------------------------------------------------ | -------- | ------------------------------------------------------------------------------------ |
    | [User access to Critical System should be valid](/integrations/spacelift/user-access-to-critical-system-should-be-valid) | Info     | Checks that everyone with Spacelift access is an active employee on the People page. |
    | [Offboarded users should not have active access](/integrations/spacelift/offboarded-users-should-not-have-active-access) | High     | Checks that offboarded employees no longer have active Spacelift access.             |
  </Tab>

  <Tab title="Useful links">
    | Topic       | Link                                                                    |
    | ----------- | ----------------------------------------------------------------------- |
    | Setup       | [Spacelift API keys](https://docs.spacelift.io/integrations/api)        |
    | Remediation | [User management](https://docs.spacelift.io/concepts/user-management)   |
    | General     | [Spacelift](https://spacelift.io)                                       |
    | DSALTA      | [Connection error messages](/troubleshooting/connection-error-messages) |
  </Tab>
</Tabs>