Aikido Security setup - Configview Support

ConfigView reads your Aikido Security workspace through Aikido’s public API, using an API client (a client ID and secret) that a workspace admin creates for ConfigView. The client belongs to the workspace, not to a person, so it keeps working when whoever set it up leaves. You will end up with 2 secrets in ConfigView (AIKIDO_CLIENT_ID, AIKIDO_CLIENT_SECRET), plus a third (AIKIDO_REGION) if your workspace is not hosted in Aikido’s default EU region.

Scope of this integration today. ConfigView reads who has an Aikido account and with what role, how they sign in and when they last logged in, teams and the code repositories, container images, clouds and domains each team is responsible for, every code repository, container image, connected cloud account, virtual machine and monitored domain, the open security issue groups with their severity and where they were found, developer laptops running Endpoint Protection, and the webhooks that send Aikido events to outside addresses. ConfigView only reads. It never changes, ignores, snoozes or closes an issue, never triggers a scan, and never reads source code, issue details, SBOM contents or cloud credentials.

Step 1: Open the Aikido page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/aikido

Step 2: Find your region

Look at the address you sign in to Aikido at:

Aikido address	`AIKIDO_REGION`
`app.aikido.dev` (EU)	leave it empty
`app.us.aikido.dev`	`us`
`app.au.aikido.dev`	`au`
`app.me.aikido.dev`	`me`

If you need to enter it, paste it into AIKIDO_REGION under Credentials and click the save icon.

Step 3: Create an API client for ConfigView

You need to be an Aikido workspace admin.

In Aikido open Settings → Integrations → Aikido API (https://app.aikido.dev/settings/integrations/api/aikido/rest, using your own regional address) and create a new client credential. Name it ConfigView
Grant read scopes only:

Scope	Used for
`basics:read`	Workspace name and linked Git provider
`users:read`	Users and roles
`teams:read`	Teams and what each is responsible for
`repositories:read`	Code repositories and container images
`clouds:read`	Connected cloud accounts
`domains:read`	Domains and APIs
`virtual_machines:read`	Virtual machines
`issues:read`	Open issue groups
`webhooks:read`	Webhooks
`endpoint_protection:read`	Endpoint Protection devices (optional)

Copy the client ID into AIKIDO_CLIENT_ID and the client secret into AIKIDO_CLIENT_SECRET under Credentials, and click the save icon. Aikido shows the secret once; if you lose it, create a new client

ConfigView exchanges the client ID and secret for a short-lived access token each time it runs, and never writes it anywhere.

Step 4: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/aikido, confirm the credentials show as saved
Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
Workspace	The Aikido workspace the API client belongs to: its name and the source-control provider and organization it is linked to.
Users	Everyone with an Aikido account, active or not: name, email, role, how they sign in (password, SSO) and when they last logged in.
Teams	Aikido teams, whether each is synced from GitHub, GitLab or Bitbucket, and which code repositories, container images, clouds and domains each team is responsible for.
Code Repositories	Every code repository Aikido scans: Git provider, branch, labels, how sensitive and how internet-connected it is, lockfile problems and when it was last scanned.
Container Images	Container images Aikido scans: registry, tag, base operating system, whether the image is running anywhere and how it is exposed to the internet.
Connected Clouds	AWS, Google Cloud, Azure and Kubernetes accounts connected to Aikido: account name, environment (production, staging, development) and when each was last scanned.
Domains	Domains and APIs Aikido monitors from the outside: type, whether authenticated scanning is set up, the repository or image each is linked to, and the last scan.
Virtual Machines	Virtual machines found in connected clouds: cloud, region, environment, operating system and version, and how many open and ignored issues each has.
Open Issue Groups	Every open security issue group in Aikido, as shown in its feed: title, type, severity, status, estimated time to fix and where it was found.
Webhooks	Webhooks that send Aikido events to outside addresses: the event, the host it goes to, and whether deliveries are succeeding. The full URL is not stored.
Endpoint Protection Devices	Developer laptops running Aikido Endpoint Protection: device, operating system, who it belongs to, permission group, protection status and last heartbeat. Skipped if the API client lacks the Endpoint Protection scope.

Click Verify now. The health check confirms ConfigView can get an access token and read your workspace, then reads one page from each kind of data.

If a check fails:

“Aikido OAuth token” fails with 400 or 401. The client ID or secret is wrong, the client was deleted, or it belongs to another region. Re-copy both, and set AIKIDO_REGION if your workspace is not on the EU region.
A check fails with “needs the … scope”. That scope was not granted to the API client. Add it in Aikido and verify again.
“Endpoint protection devices” is skipped. The client lacks endpoint_protection:read, or your plan has no Endpoint Protection. The table stays empty and nothing fails.

Data Tables

Once the scripts run, these tables are created in your database. Each includes a run_at column and keeps only the newest run.

Table	Source	Key Columns
`aikido_workspace`	`GET /workspace`	workspace_id, name, linked_provider, linked_provider_org_name, git_base_url
`aikido_users`	`GET /users`	user_id, full_name, email, role, auth_type, active, last_login
`aikido_teams`	`GET /teams`	team_id, name, external_source, external_source_id, active, resource_count, code_repo_count, container_repo_count, cloud_count, domain_count
`aikido_team_resources`	`GET /teams`	team_id, team_name, resource_type, resource_id, included_paths, excluded_paths
`aikido_code_repos`	`GET /repositories/code`	repo_id, name, project, provider, url, branch, connectivity, sensitivity, labels, has_missing_lockfile, has_faulty_lockfile, last_scanned_at
`aikido_container_repos`	`GET /containers`	container_id, name, provider, registry_name, tag, distro, distro_version, is_active, is_running, exposed_via, connectivity, sensitivity, last_scanned_at
`aikido_clouds`	`GET /clouds`	cloud_id, name, provider, environment, external_id, last_scanned_at
`aikido_domains`	`GET /domains`	domain_id, domain, kind, is_auth_configured, linked_resource_type, linked_resource_id, last_scanned_at
`aikido_virtual_machines`	`GET /virtual-machines`	vm_id, name, cloud_id, cloud_kind, region, environment, os, os_version, count_open_issues, count_ignored_issues, last_scanned_at
`aikido_issue_groups`	`GET /open-issue-groups`	group_id, title, issue_type, severity, severity_score, group_status, time_to_fix_minutes, location_count, location_names, first_detected_at
`aikido_webhooks`	`GET /webhooks`	webhook_id, event_type, target_host, health_status, latest_http_status_code
`aikido_endpoint_devices`	`GET /endpoint-protection/devices`	device_id, name, os, agent_version, serial_number, user_name, permission_group_name, status, last_heartbeat_at

Things worth knowing

Aikido’s API is slow on purpose. Aikido allows 20 calls a minute per workspace, shared by every API client you have. ConfigView sends one request at a time and keeps to 15 a minute, so a full run takes a few minutes, and a very large workspace (thousands of repositories or issue groups) takes longer. If Aikido has raised your limit, ask us to raise ConfigView’s pace. Roles are admin, default and team_only. team_only users see only the resources of their teams. Inactive users are included, with active = 0. Open issue groups, not every issue. The table holds the open groups shown in Aikido’s feed, with the places each was found. Closed, ignored and snoozed issues are not collected, and there is no per-issue detail. Webhook destinations are stored as hosts. target_host is the host events are sent to, never the full URL, which can carry a token. Container images that are exposed. exposed_via says how a running image can be reached from the internet: direct, lb (load balancer), limited_ips, or none.

What isn’t collected

The client secret, access tokens and webhook signing secrets
Source code, SBOM and license contents, and issue-level details such as the vulnerable file or package
Cloud account credentials and the cloud assets themselves
Closed, ignored and snoozed issues, pull request check results and autofix history
Webhook URLs (only the host)

​Step 1: Open the Aikido page in ConfigView

​Step 2: Find your region

​Step 3: Create an API client for ConfigView

​Step 4: Connect and verify

​Data Tables

​Things worth knowing

​What isn’t collected