MongoDB Atlas

Connect MongoDB Atlas to collect infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In MongoDB Atlas:

   1. Sign in to Atlas as an Organization Owner and select your organization from the Organizations menu in the navigation bar.
   2. In the sidebar under Identity & Access, click Applications.
   3. API key (Public key + Private key): click Add new › API Key. Enter a Description, and in the Organization Permissions menu select the role or roles for the key. Click Next.
   4. Copy and save the Public Key, then click the Copy button for the Private Key. The Private Key is only shown once, on this page.
   5. Click Add Access list Entry, enter Safeguard's egress IP address or CIDR block, click Save, then click Done.
   6. Alternative (Client ID + Client secret): on the same Applications page click Add new › Service Account. Enter a Name and Description, select a duration from the Client Secret Expiration menu, select the role or roles from the Organization Permissions menu, and click Create.
   7. Click Copy to save the Client Secret (it begins with mdb_sa_sk_). This is the only time you can view the full client secret. Then click Add Access List Entry, enter Safeguard's IP address or CIDR block, and click Save.
   8. To give a project access: select the project under All Projects (sidebar, Identity & Access), click Project Identity & Access under Security, click Invite to Project, type the API key's public key and choose roles in the Project Permissions menu (for a service account, start typing its client ID and choose roles in the menu that appears), then click Invite to Project.

   Where to find the other values:

   • Environment (optional): Not documented on the fetched Atlas pages.

   MongoDB Atlas shows the secret only once, so copy it before you leave the page.

   MongoDB Atlas's public documentation does not cover every step.

   Source: mongodb.com, mongodb.com, checked 2026-10-07.

   The permissions Safeguard needs: Organization Read Only, Project Read Only.

2. On Compliance › Connectors, open MongoDB Atlas, click Connect, choose API token and fill in:

   Field	What to enter
   Public key	Optional. Stored encrypted and never shown again.
   Private key (PEM)	Optional. Stored encrypted and never shown again.
   Organization ID (optional)	—
   Environment (optional)	—

   Or, instead: Client ID (optional), Client secret (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read MongoDB Atlas and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks