Endor Labs
Connect Endor Labs to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Endor Labs to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Endor Labs's guide | docs.endorlabs.com |
Connect with an API token
-
In Endor Labs:
- In Endor Labs, switch to the namespace Safeguard should read (the key applies to the current namespace and its child namespaces).
- Select User menu › Settings from the left sidebar.
- Select Access Control › API Keys, then click Generate API Key.
- Enter a name to identify the API key and select the role Read-only.
- Select the expiry (30, 60, 90 days, or one year).
Where to find the other values:
- Namespace: The namespace you are in when you generate the key (the key applies to it and, unless you deselect Propagate this policy to all child namespaces under Advanced, its child namespaces).
- Region: API keys are region-bound: EU tenants create keys at https://app.eu.endorlabs.com.
Endor Labs's public documentation does not cover every step.
Keys created in the UI can expire after at most one year; the API can create longer-lived keys. Each session started with the key is valid up to four hours. The fetched page stops after the expiry choice: it does not name the final button, say how the API key and API secret are displayed or copied, or whether the secret is shown only once. Only the EU tenant URL is named in the docs.
Source: docs.endorlabs.com, checked 2026-10-07.
The permissions Safeguard needs:
Read-Only. -
On Compliance › Connectors, open Endor Labs, click Connect, choose API token and fill in:
Field What to enter API key Required. Stored encrypted and never shown again. API secret Required. Stored encrypted and never shown again. Namespace Required. Region Required. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Endor Labs and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.1 | 4 |
| ISO/IEC 27001 | Automated tests | A.8.8 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1) | 4 |
| PCI DSS | Automated tests | 6.3.3, 11.3.1 | 4 |
| NIST CSF 2.0 | Automated tests | ID.RA-01, ID.RA-06 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks