Stream Security

Record your Stream Security connection as cspm evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Stream Security:

   1. Sign in to the Stream UI as an Organization Admin or Workspace Admin.
   2. Open Organization or Workspace settings (depending on your role) and select the API Token Management tab.
   3. Click Create API Token and fill in Name, an optional Description, Permission (choose Read Only if your account offers it, otherwise Read & Write), Scope (organization-wide or selected workspaces; Workspace Admins can scope only to their workspace) and Expiration (1 day, 7 days, 30 days, 90 days, 1 year, or never).
   4. Copy the full token and store it securely; it is shown only once.

   Where to find the other values:

   • Base URL (optional): The Stream platform host you sign in to. The fetched Stream docs do not name it.
   • Account / Org / Workspace (optional): In the Stream UI, open the left navigation and click your workspace; in the panel that opens, hover over the workspace, click the 3-dots menu and select Copy ID.

   Stream Security shows the secret only once, so copy it before you leave the page.

   Stream Security's docs live at docs.streamsec.io (not stream.security); the markdown variants of the pages were read. The token management page marks the Read Only permission as 'will be supported soon', so only Read & Write may be available. Requests run against the workspace linked to the token by default; a Workspace ID targets one workspace when the token covers several. When a user is deactivated, their tokens are revoked automatically, and a lower role revokes tokens that exceed it. The app.streamsec.io host comes from Stream's official Terraform provider docs.

   Source: docs.streamsec.io, docs.streamsec.io, docs.streamsec.io, raw.githubusercontent.com, checked 2026-10-07.

2. On Compliance › Connectors, open Stream Security, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

Stream Security publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.

These tests are switched on per workspace by the Safeguard team.

Related

• CSPM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks