FusionAuth
Connect FusionAuth to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect FusionAuth to collect identity & sso evidence with automated compliance tests, switched on per workspace.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| FusionAuth's guide | fusionauth.io |
Connect with an API token
-
In FusionAuth:
- In the FusionAuth admin UI, navigate to Settings › API Keys and add a new API key.
- Optionally set Tenant to the tenant Safeguard should read (this cannot be changed after the key is created).
- In the endpoint permissions grid, enable only GET on /api/user/search and /api/tenant; leave every other method and endpoint off.
- Choose Retrievable (default) or Not Retrievable, save the key, and copy it.
Where to find the other values:
- Instance URL: The https address of your FusionAuth server, the same base address as the admin UI (without /admin).
If you pick Not Retrievable the key cannot be retrieved after creation, so copy it at once. Clicking an HTTP method column or endpoint row toggles the whole column or row. The fetched page did not say where the Tenant ID and Application ID are shown in the admin UI; both optional fields can stay blank.
Source: fusionauth.io, checked 2026-10-07.
The permissions Safeguard needs:
GET /api/user/search,GET /api/tenant. -
On Compliance › Connectors, open FusionAuth, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. Your own server: an https address reachable from the internet. API key Required. Stored encrypted and never shown again. Tenant ID (optional) — Application ID (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read FusionAuth and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3 | 4 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.5 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.312(d) | 4 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5, 8.2.6, 8.4.2 | 4 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-03, PR.AA-05 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks