Vercel setup - Configview Support

ConfigView reads your Vercel team through the Vercel REST API (https://api.vercel.com), using an access token that someone on the team creates in Vercel. ConfigView sends only GET requests. It never creates, changes or deletes anything in Vercel. You will end up with 2 required secrets (VERCEL_API_TOKEN, VERCEL_TEAM_ID) in ConfigView when setup is complete.

Scope of this integration today. ConfigView reads who is on your Vercel team and in which role, pending invites, who has access to each project and through which access groups, each project’s deployment protection (Vercel Authentication and password protection), firewall and attack mode settings, the team’s SAML single sign-on and SCIM settings, environment variable names and types (never values), installed integrations with the scopes they hold, domains and their expiry, and the webhooks and drains that send data out of Vercel. It also keeps a running history of the team’s activity feed (role changes, invites, token and integration changes). It does not read deployments, build or runtime logs, source code, environment variable values or billing data.

Read this first: Vercel tokens cannot be read-only

Vercel has no read-only access token and no scopes on a token. A token can do everything the user who created it can do in the team it is scoped to. Anyone who gets hold of the token could, in principle, change settings or delete projects, even though ConfigView itself only ever reads. What you can do about it:

Create the token from a dedicated user (for example configview@yourcompany.com) rather than from a person’s account, so it does not stop working when someone leaves.
Give that user the lowest team role that still lets everything below work. Vercel does not publish which role each endpoint needs, so start with Member and use Verify now (step 4). If a check says it is not available, that area needs a higher role; decide whether you want it. Do not use Owner unless you need the activity feed.
Set the token’s Scope to the one team you want ConfigView to read, never Full Account.
Choose an expiration, and put a reminder in your calendar to replace the token before it lapses. An expired token makes every collector fail with a 401.

What you need

A Vercel team (any plan). Pro and Enterprise teams have more to read: access groups, SAML and SCIM, and the activity feed depend on your plan and the user’s role. If an area is not available, that collector skips itself and its table stays empty. That does not count as a failure.
Someone who can add a user to the team and create a token

Step 1: Open the Vercel page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/vercel

Step 2: Add the user and create the token

In Vercel open your team, then Settings → Members → Invite and invite the dedicated user with the role you chose above. Accept the invite as that user.
Signed in as that user, open Account Settings → Tokens (https://vercel.com/account/tokens)
Enter the name ConfigView
Under Scope choose your team (not Full Account)
Pick an Expiration and click Create
Copy the token now. Vercel shows it only once.
In the ConfigView tab paste it into VERCEL_API_TOKEN under Credentials and click the save icon

Step 3: Add the team ID

In Vercel open your team’s Settings → General
Copy the Team ID. It starts with team_. The team slug (the name in your dashboard address) also works.
Paste it into VERCEL_TEAM_ID in ConfigView and click the save icon

Step 4: Connect and verify

Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
Team Settings	Plan, SAML and SCIM, member policies, sensitive environment variable policy, team-wide protection defaults.
Members and Invites	Everyone on the team with their role, and pending email invites.
Projects	Every project with its Git repository, deployment protection, firewall and latest deployment.
Project Members	Who has access to each project, at which role. Makes one request per project.
Access Groups	Groups, their members and projects. Skipped if your plan has none.
Environment Variables	Names, types and targets of project and shared variables. Makes one request per project. Values are never read.
Domains and Project Domains	Team domains with expiry, and which domain serves which project.
Installed Integrations	Integrations and Marketplace products, with their scopes.
Webhooks and Drains	Where Vercel sends events, logs and traces. Host only.
Audit Events	The activity feed, kept as a history. Skipped if the token’s user cannot read it.

Click Verify now. The health check reads both secrets, reads the team, then tries one small request for every area.

If a check fails:

Team fails with 401. The token is wrong, expired or was revoked. Create a new one.
Team fails with 403 or 404. The token is scoped to a different team than VERCEL_TEAM_ID, or the user is not in the team.
Members, Projects, Domains, Integrations, Webhooks or Drains fail with 403. The token’s user has a role that cannot read that area. Give the user a higher role, or accept the gap.
Access groups or the activity feed show as skipped. Your plan or the user’s role does not include them. Nothing to fix unless you want that area.

Data Tables

Once the scripts run, these tables are created in your database. Each table has a run_at column. Every table except vercel_audit_events keeps only the newest run; vercel_audit_events keeps its history.

Table	Source	Key Columns
`vercel_team`	`GET /v2/teams/{teamId}`	team_id, plan, saml_enforced, scim_connected_at, new_member_policy, sensitive_env_policy, default_sso_protection, strict_deployment_protection
`vercel_members`	`GET /v3/teams/{teamId}/members`	member_uid, email, username, role, confirmed, joined_origin, sso_connected, scim_managed, project_count
`vercel_invites`	`GET /v3/teams/{teamId}/members` (`emailInviteCodes`)	email, role, expired, invited_at
`vercel_projects`	`GET /v10/projects`	project_id, name, framework, git_provider, git_repo, sso_protection, password_protection, firewall_enabled, deploy_hook_count, last_deployed_at
`vercel_project_members`	`GET /v1/projects/{id}/members`	project_id, email, project_role, computed_project_role, team_role
`vercel_access_groups`	`GET /v1/access-groups`	group_id, name, members_count, projects_count, is_scim_managed
`vercel_access_group_members`	`GET /v1/access-groups/{id}/members`	group_id, email, team_role
`vercel_access_group_projects`	`GET /v1/access-groups/{id}/projects`	group_id, project_id, project_role
`vercel_env_vars`	`GET /v10/projects/{id}/env`	project_id, env_key, env_type, is_plaintext, is_sensitive, targets, updated_at
`vercel_shared_env_vars`	`GET /v1/env`	env_key, env_type, is_plaintext, targets, project_count
`vercel_domains`	`GET /v5/domains`	domain, verified, auto_renew, expires_at, nameservers, creator_email
`vercel_project_domains`	`GET /v9/projects/{id}/domains`	project_id, domain, verified, redirect_target, git_branch
`vercel_integrations`	`GET /v1/integrations/configurations`	slug, integration_name, status, scopes, all_projects, project_count, installed_by_uid
`vercel_webhooks`	`GET /v1/webhooks`	webhook_id, target_host, events
`vercel_drains`	`GET /v1/drains`	drain_id, delivery_type, target_host, status, data_types, delivery_state
`vercel_audit_events`	`GET /v3/events`	event_id, created_at, event_type, actor_email, event_text

Things worth knowing

Deployment protection is the main thing to watch. A project whose sso_protection is empty has no Vercel Authentication, so its preview deployments (and, depending on the setting, production URLs) are open to anyone with the address. vercel_team.default_sso_protection is the default new projects get. Plain versus sensitive variables. env_type is plain (readable in the dashboard by anyone with access), encrypted, or sensitive (cannot be read back after it is saved). is_plaintext marks the first kind. Variable names that look like keys or passwords and are stored as plain are worth a look. Integrations hold scopes. Each installed integration lists the permission scopes it was granted and whether it can reach all projects. Review the ones you no longer use. Invite and member roles. OWNER can change anything; MEMBER and DEVELOPER can deploy; VIEWER, BILLING and SECURITY are narrower. Pending invites are shown with the role they would receive. Tokens other people created are not visible. The Vercel API lists only the token owner’s own tokens, so ConfigView cannot show who else on the team holds a personal access token. The activity feed records when tokens are created or deleted. The activity feed. Audit Events are collected from the first run back 90 days, then every run adds what is new. Routine events (deployments, aliases, scaling) are left out. Vercel’s full audit log export is a separate Enterprise feature; this is the team activity feed available through the API. Rate limit. Vercel publishes per-action limits (for example 500 requests a minute to read a project’s environment variables) and no single figure for the list endpoints. ConfigView paces itself at 60 requests a minute (120 for environment variables) and waits as long as Vercel asks after an HTTP 429. Project Members, Environment Variables and Project Domains make one request per project, so they take a few minutes on a team with hundreds of projects.

What isn’t collected

Environment variable values (the API returns them for plain variables and as ciphertext for encrypted ones; ConfigView never reads that field)
Deploy hook URLs (only how many a project has), the team’s invite link code, the password-protection password, and the SAML role mapping
Drain headers and secrets, and the path or query of any drain or webhook address. Only the host is stored
Deployments, build and runtime logs, source code, Edge Config contents, Blob and database data
Billing and invoices

​Read this first: Vercel tokens cannot be read-only

​What you need

​Step 1: Open the Vercel page in ConfigView

​Step 2: Add the user and create the token

​Step 3: Add the team ID

​Step 4: Connect and verify

​Data Tables

​Things worth knowing

​What isn’t collected