> ## Documentation Index
> Fetch the complete documentation index at: https://support.configview.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Aikido Security setup

ConfigView reads your Aikido Security workspace through Aikido's public API, using an **API client** (a client ID and secret) that a workspace admin creates for ConfigView. The client belongs to the workspace, not to a person, so it keeps working when whoever set it up leaves.

You will end up with **2 secrets** in ConfigView (`AIKIDO_CLIENT_ID`, `AIKIDO_CLIENT_SECRET`), plus a third (`AIKIDO_REGION`) if your workspace is not hosted in Aikido's default EU region.

> **Scope of this integration today.** ConfigView reads who has an Aikido account and with what role, how they sign in and when they last logged in, teams and the code repositories, container images, clouds and domains each team is responsible for, every code repository, container image, connected cloud account, virtual machine and monitored domain, the open security issue groups with their severity and where they were found, developer laptops running Endpoint Protection, and the webhooks that send Aikido events to outside addresses. ConfigView only reads. It never changes, ignores, snoozes or closes an issue, never triggers a scan, and never reads source code, issue details, SBOM contents or cloud credentials.

***

## Step 1: Open the Aikido page in ConfigView

Open ConfigView in a second browser tab and leave it open:

`https://{companyname}.configview.com/admin/integrations/aikido`

***

## Step 2: Find your region

Look at the address you sign in to Aikido at:

| Aikido address | `AIKIDO_REGION` |
| - | - |
| `app.aikido.dev` (EU) | leave it empty |
| `app.us.aikido.dev` | `us` |
| `app.au.aikido.dev` | `au` |
| `app.me.aikido.dev` | `me` |

If you need to enter it, paste it into `AIKIDO_REGION` under **Credentials** and click the save icon.

***

## Step 3: Create an API client for ConfigView

You need to be an Aikido **workspace admin**.

1. In Aikido open **Settings → Integrations → Aikido API** (`https://app.aikido.dev/settings/integrations/api/aikido/rest`, using your own regional address) and create a new client credential. Name it `ConfigView`
2. Grant **read** scopes only:

| Scope | Used for |
| - | - |
| `basics:read` | Workspace name and linked Git provider |
| `users:read` | Users and roles |
| `teams:read` | Teams and what each is responsible for |
| `repositories:read` | Code repositories and container images |
| `clouds:read` | Connected cloud accounts |
| `domains:read` | Domains and APIs |
| `virtual_machines:read` | Virtual machines |
| `issues:read` | Open issue groups |
| `webhooks:read` | Webhooks |
| `endpoint_protection:read` | Endpoint Protection devices (optional) |

3. Copy the **client ID** into `AIKIDO_CLIENT_ID` and the **client secret** into `AIKIDO_CLIENT_SECRET` under **Credentials**, and click the save icon. Aikido shows the secret once; if you lose it, create a new client

ConfigView exchanges the client ID and secret for a short-lived access token each time it runs, and never writes it anywhere.

***

## Step 4: Connect and verify

1. Back on `https://{companyname}.configview.com/admin/integrations/aikido`, confirm the credentials show as saved
2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don't want under **Collectors**:

| Script | Notes |
| - | - |
| **Workspace** | The Aikido workspace the API client belongs to: its name and the source-control provider and organization it is linked to. |
| **Users** | Everyone with an Aikido account, active or not: name, email, role, how they sign in (password, SSO) and when they last logged in. |
| **Teams** | Aikido teams, whether each is synced from GitHub, GitLab or Bitbucket, and which code repositories, container images, clouds and domains each team is responsible for. |
| **Code Repositories** | Every code repository Aikido scans: Git provider, branch, labels, how sensitive and how internet-connected it is, lockfile problems and when it was last scanned. |
| **Container Images** | Container images Aikido scans: registry, tag, base operating system, whether the image is running anywhere and how it is exposed to the internet. |
| **Connected Clouds** | AWS, Google Cloud, Azure and Kubernetes accounts connected to Aikido: account name, environment (production, staging, development) and when each was last scanned. |
| **Domains** | Domains and APIs Aikido monitors from the outside: type, whether authenticated scanning is set up, the repository or image each is linked to, and the last scan. |
| **Virtual Machines** | Virtual machines found in connected clouds: cloud, region, environment, operating system and version, and how many open and ignored issues each has. |
| **Open Issue Groups** | Every open security issue group in Aikido, as shown in its feed: title, type, severity, status, estimated time to fix and where it was found. |
| **Webhooks** | Webhooks that send Aikido events to outside addresses: the event, the host it goes to, and whether deliveries are succeeding. The full URL is not stored. |
| **Endpoint Protection Devices** | Developer laptops running Aikido Endpoint Protection: device, operating system, who it belongs to, permission group, protection status and last heartbeat. Skipped if the API client lacks the Endpoint Protection scope. |

3. Click **Verify now**. The health check confirms ConfigView can get an access token and read your workspace, then reads one page from each kind of data.

If a check fails:

* **"Aikido OAuth token" fails with 400 or 401.** The client ID or secret is wrong, the client was deleted, or it belongs to another region. Re-copy both, and set `AIKIDO_REGION` if your workspace is not on the EU region.
* **A check fails with "needs the ... scope".** That scope was not granted to the API client. Add it in Aikido and verify again.
* **"Endpoint protection devices" is skipped.** The client lacks `endpoint_protection:read`, or your plan has no Endpoint Protection. The table stays empty and nothing fails.

***

## Data Tables

Once the scripts run, these tables are created in your database. Each includes a `run_at` column and keeps only the newest run.

| Table | Source | Key Columns |
| - | - | - |
| `aikido_workspace` | `GET /workspace` | workspace\_id, name, linked\_provider, linked\_provider\_org\_name, git\_base\_url |
| `aikido_users` | `GET /users` | user\_id, full\_name, email, role, auth\_type, active, last\_login |
| `aikido_teams` | `GET /teams` | team\_id, name, external\_source, external\_source\_id, active, resource\_count, code\_repo\_count, container\_repo\_count, cloud\_count, domain\_count |
| `aikido_team_resources` | `GET /teams` | team\_id, team\_name, resource\_type, resource\_id, included\_paths, excluded\_paths |
| `aikido_code_repos` | `GET /repositories/code` | repo\_id, name, project, provider, url, branch, connectivity, sensitivity, labels, has\_missing\_lockfile, has\_faulty\_lockfile, last\_scanned\_at |
| `aikido_container_repos` | `GET /containers` | container\_id, name, provider, registry\_name, tag, distro, distro\_version, is\_active, is\_running, exposed\_via, connectivity, sensitivity, last\_scanned\_at |
| `aikido_clouds` | `GET /clouds` | cloud\_id, name, provider, environment, external\_id, last\_scanned\_at |
| `aikido_domains` | `GET /domains` | domain\_id, domain, kind, is\_auth\_configured, linked\_resource\_type, linked\_resource\_id, last\_scanned\_at |
| `aikido_virtual_machines` | `GET /virtual-machines` | vm\_id, name, cloud\_id, cloud\_kind, region, environment, os, os\_version, count\_open\_issues, count\_ignored\_issues, last\_scanned\_at |
| `aikido_issue_groups` | `GET /open-issue-groups` | group\_id, title, issue\_type, severity, severity\_score, group\_status, time\_to\_fix\_minutes, location\_count, location\_names, first\_detected\_at |
| `aikido_webhooks` | `GET /webhooks` | webhook\_id, event\_type, target\_host, health\_status, latest\_http\_status\_code |
| `aikido_endpoint_devices` | `GET /endpoint-protection/devices` | device\_id, name, os, agent\_version, serial\_number, user\_name, permission\_group\_name, status, last\_heartbeat\_at |

***

## Things worth knowing

**Aikido's API is slow on purpose.** Aikido allows 20 calls a minute per workspace, shared by every API client you have. ConfigView sends one request at a time and keeps to 15 a minute, so a full run takes a few minutes, and a very large workspace (thousands of repositories or issue groups) takes longer. If Aikido has raised your limit, ask us to raise ConfigView's pace.

**Roles are `admin`, `default` and `team_only`.** `team_only` users see only the resources of their teams. Inactive users are included, with `active = 0`.

**Open issue groups, not every issue.** The table holds the open groups shown in Aikido's feed, with the places each was found. Closed, ignored and snoozed issues are not collected, and there is no per-issue detail.

**Webhook destinations are stored as hosts.** `target_host` is the host events are sent to, never the full URL, which can carry a token.

**Container images that are exposed.** `exposed_via` says how a running image can be reached from the internet: `direct`, `lb` (load balancer), `limited_ips`, or `none`.

## What isn't collected

* The client secret, access tokens and webhook signing secrets
* Source code, SBOM and license contents, and issue-level details such as the vulnerable file or package
* Cloud account credentials and the cloud assets themselves
* Closed, ignored and snoozed issues, pull request check results and autofix history
* Webhook URLs (only the host)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.