Connect GitLab

Imports users, memberships, access tokens, projects and dependencies from GitLab (SaaS or self-managed), for IAM, privileged-access, credential-hygiene and software-inventory metrics.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• A GitLab account with Admin rights — an Admin token is what gives full instance-wide user and token visibility

• GitLab Ultimate for the dependencies table (SBOM / SCA)

• For a self-managed instance, its URL

Step 1 — Determine the base URL

For GitLab SaaS the URL is https://gitlab.com. For a self-managed instance, use its URL, e.g. https://gitlab.example.com.

Step 2 — Create an access token

1. Click your avatar → Edit profile

2. Open Access tokens → Add new token

3. Name it HARVEN and select the read_api scope

4. Set an expiry date

5. Click Create personal access token and copy the value — it is shown only once

An Admin token is required to list instance-wide users and access tokens. With a narrower token the connector still works, but only over what that token can see.

Step 3 — Configure the connector in HARVEN

1. Open Workspace → Data sources → Add → GitLab

2. Enter the base URL and paste the access token

3. Test the connection before saving

About dependencies

The dependencies table (SBOM / SCA) requires GitLab Ultimate. Without Ultimate the other tables work normally and the dependencies table stays empty.

What to enter in HARVEN

• Base URL — Your GitLab URL, https://gitlab.com for SaaS (address bar of your GitLab)

• Access token — Personal or group access token with the read_api scope, Admin recommended (GitLab → Edit profile → Access tokens)

What HARVEN reads

• users — GitLab users: state, locked, two_factor_enabled, is_admin, last_activity_on — MFA, account state, admin rights and dormancy

• memberships — Group and project memberships: access_level, source_type, source_name — effective access level

• access_tokens — Personal access tokens: scopes, active, revoked, last_used_at, expires_at — credential scopes, activity and expiry

• projects — Projects and their visibility: visibility, archived — source-code exposure

• dependencies — Dependencies, Ultimate only: name, version, package_manager, vulnerabilities — software inventory and known vulnerabilities

Official documentation

• GitLab personal access tokens

Need help? Contact [email protected].