Fivetran
Setup guide.

Before you start

• A Fivetran account and an Account Administrator who can create System Keys.

Read-only permissions

Create a System Key with READ access only:

Never grant MANAGE on any scope. Record the key owner and rotate the secret on schedule.

Connect Fivetran

1. In Fivetran, create a System Key with the READ scopes above.
2. Copy the API key and API secret.
3. In KeySkope, open Data sources → Add data source → Fivetran, enter both values and save. The first sync starts straight away.

Connection fields

What appears in KeySkope

• Every user with their account role, active and invited state, and last sign-in (Fivetran returns it for every user, so no sign-in means never signed in).
• Destination and connection memberships, held directly or through a team, with the team named as the source.
• Roles rated low to critical; Account Administrator is critical.
• Flags: account administrators, destination creators, never signed in, stale sign-in, pending invitations, service accounts and privileged API keys.
• Without DESTINATION and CONNECTOR read, memberships show as permission denied and nothing already recorded is removed.
• Whether a user signs in with SSO is not reported by the API, so KeySkope does not guess it.

Verify the first sync

1. Check that Accounts, Roles and Activity show complete.
2. Compare the user count and one administrator’s role with Fivetran’s Users page.

Troubleshooting

Official references

• Fivetran REST API: getting started