Imports users, memberships, access tokens, projects and dependencies from GitLab (SaaS or self-managed) for IAM, privileged-access, credential-hygiene and software-inventory metrics.
For the general flow of adding a source, see Connect Data Sources.
Prerequisites
A GitLab account with Admin rights: its token gives full instance-wide user and token visibility, and is the only kind that can read memberships
Ultimate edition for the dependencies table (SBOM / SCA)
For self-managed, note your instance URL
Setup
Step 1 — Determine the base URL
For GitLab SaaS the URL is https://gitlab.com. For a self-managed instance, use its URL, e.g. https://gitlab.example.com.
Step 2 — Create an access token (read_api)
Click your avatar → Edit profile
Access tokens → Add new token
Name it HARVEN and select the read_api scope
Set an expiry date
Click Create personal access token and copy the value (shown once)
An Admin token is required to list instance-wide users and access tokens, and to read memberships at all. With a narrower token the other tables still work, but only over what that token can see, and queries on memberships fail. On gitlab.com, where no customer account is an instance Admin, memberships cannot be read.
About dependencies
The dependencies table (SBOM / SCA) requires GitLab Ultimate. Without Ultimate, the other tables work normally and the dependencies table stays empty.
Fields to fill in HARVEN
Field | Where to find it |
|---|---|
Base URL | Address bar of your GitLab |
Access token | GitLab → Edit profile → Access tokens |
Collected data
users — GitLab users: MFA, account state, admin, dormancy (state, locked, two_factor_enabled, is_admin, last_activity_on)
memberships — Direct group and project memberships: Access level granted on each group or project (access inherited from a parent group is not listed) (access_level, source_type, source_name)
access_tokens — Personal access tokens: Credential scopes, activity and expiry (scopes, active, revoked, last_used_at, expires_at)
projects — Projects and visibility: Source-code exposure (visibility, archived)
dependencies — Dependencies (Ultimate): Software inventory and known vulnerabilities (name, version, package_manager, vulnerabilities)
Official documentation
Need help? Contact [email protected].