Lacework

Connect Lacework to collect cspm evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Lacework:

   1. In the Lacework FortiCNAPP Console, go to Settings › Configuration › API keys.
   2. Create an API key, then download the key file and store it securely; the secret cannot be retrieved later. The JSON file contains keyId, secret and account.
   3. Exchange the key for an access token with POST https://YourLacework.lacework.net/api/v2/access/tokens, sending the secret in the X-LW-UAKS header and \{"keyId": "<keyId>", "expiryTime": 3600\} as the body, and paste the returned token into Safeguard's API token / Personal access token field.
   4. For least privilege, create the key for a service user with read-only access rather than a full-access user (FortiCNAPP's recommendation).

   Where to find the other values:

   • Base URL (optional): Your Lacework account URL, https://YourLacework.lacework.net (the address of your FortiCNAPP Console).
   • Account / Org / Workspace (optional): The account value in the downloaded API key JSON file.

   Lacework shows the secret only once, so copy it before you leave the page.

   Lacework's public documentation does not cover every step.

   Lacework is now Lacework FortiCNAPP (Fortinet); docs.lacework.net no longer resolves. Access tokens default to 3600 seconds and can last at most 86400 seconds (one day), so a pasted token expires quickly. Not sourced: the button label on the API keys page and the click path for creating a read-only service user.

   Source: docs.fortinet.com, checked 2026-10-07.

2. On Compliance › Connectors, open Lacework, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Lacework and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• CSPM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks