KeySkopePreview · Reviewed 2026-10-08
Preview: implemented and tested with fixtures shaped like the documented API responses.
Before you start
- A Celigo (integrator.io) account and an account owner or administrator who can invite users.
- A dedicated mailbox for the KeySkope service user, so the token is not tied to a person who may leave.
- Know which region your account lives in (North America, Europe, Australia or Canada). Tokens only work in their own region.
Read-only permissions
KeySkope uses a personal access token of a dedicated user with the Monitor all role. Monitor can view but never change anything, and the connector only ever sends read requests to two endpoints:
| Endpoint | Used for |
|---|---|
GET /v1/ashares | Every user with access to the account: access level, per-integration grants, SSO link and MFA settings, last sign-in, invitation state. |
GET /v1/integrations | Only to show integration names instead of IDs. If it cannot be read, the IDs are shown and the sync continues. |
Celigo does not expose the audit log, SSO client settings or the token inventory to a Monitor token, and KeySkope does not ask for them. The Monitor role can also view integrations and connections metadata in Celigo itself; KeySkope reads only the user list and integration names.
Connect Celigo
- In Celigo, go to Account → Users → Invite user. Use the dedicated mailbox, role Monitor all, no integration access, and leave Users can edit retry data off.
- Sign in as that user and create a personal access token (avatar → My profile). Choose the shortest expiry your rotation process supports (the maximum is 90 days). Copy it once.
- In KeySkope, open Data sources → Add data source → Celigo. Pick the region, paste the token, optionally enter the service user’s email so it is tagged as a service account, and save. The first sync starts straight away.
- Rotate the token before it expires. Disabling or deleting the service user stops syncing.
Connection fields
| Setting | Purpose / value |
|---|---|
| region | Where the account lives: North America, Europe, Australia or Canada. Selects the API host. |
| token | The Monitor user’s personal access token. Stored per tenant in the secret store; never shown again and never logged. |
| service_email | Optional. The Monitor user’s email. That account is tagged as a service account and kept out of people counts. |
What appears in KeySkope
- Every user with access to the account and their access level exactly as Celigo reports it: Administrator and Manage count as privileged; Monitor does not. A user with no account-level role shows as Integration-scoped.
- Per-integration grants (manage or monitor) as their own access rows, named after the integration; MCP server grants where present.
- Sign-in method: accounts that are not linked to your identity provider and where SSO is not required are flagged Local login. MFA: accounts without enforced multi-factor authentication are flagged MFA not enforced. Both come from Celigo, not from inference.
- Last sign-in for each user, so dormant access is visible.
- Disabled users as suspended accounts; pending invitations reported with the sync, not as accounts.
- Changes over time are derived from differences between syncs, since a Monitor token cannot read Celigo’s audit log.
- If a sync cannot read the user list, nothing is removed.
Verify the first sync
- Check that Accounts, Roles and Activity all show complete.
- Compare the user count and one administrator’s level with Account → Users in Celigo.
- Open the Celigo application in KeySkope and review the Local login chip: those users do not sign in through your identity provider.
Troubleshooting
| Symptom | Cause / fix |
|---|---|
| Token rejected (401) | The token expired (90 days at most) or was revoked, or it was created in another region than the one selected. Create a new token on the Monitor user and enter it again. |
| Cannot list users (403) | The token’s user does not have the Monitor all role. Recreate the token as a user with that role. |
| Integration IDs instead of names | The token could not read /v1/integrations. Users and access still sync; names appear once the role allows it. |
| Sync stale | The token is close to or past expiry, or the service user was disabled. Rotate the token. |