Spacelift

Spacelift is an infrastructure-as-code management platform that orchestrates Terraform, OpenTofu, Pulumi and other IaC workflows with policy-based access control and CI/CD automation.

Use Cases the Adapter Solves

• Review Spacelift access: Identify managed users and their account status to support access reviews.
• Monitor infrastructure administration: Review configured application settings for administrative stacks, automatic deployments, and deletion protection.

Asset Types Fetched

• Users
• Application Settings

Data Retrieved through the Adapter

Users - fields such as: Username, Invitation Email, Status, Login Method

Application Settings - settings such as: Audit Trail Webhook Enabled, API Key Admin, Managed User Status, Stack Protect From Deletion

Before You Begin

Required Ports

TCP port 443 (HTTPS)

Authentication Methods

The adapter uses API key authentication.

APIs

Axonius uses the Spacelift API. The following API request is called:

• POST /graphql - Retrieves a JWT for API key authentication, managed users, and optional application settings.

  The API queries the following:

  GraphQL Query	Data Retrieved
  managedUsers	All IAM-managed users (username, login method, status, last login)
  auditTrailWebhook	Audit trail webhook configuration
  apiKeys	All API keys (name, admin flag, expiry)
  stacks	All stacks (name, space, administrative flag, autodeploy settings)

Required Permissions

Option 1: Root Admin API Key (Recommended)

Spacelift's managedUsers, apiKeys, and auditTrailWebhook queries are organization-level resources accessible only through Organization Settings, which requires Root Space Admin (Admin/Owner) access.

Create the API key as a Root Admin key:

1. In Spacelift, go to your name/avatar (lower-left) → Organization Settings → API Keys.
2. Click Create API key.
3. Enable the Admin toggle — this grants the key Root Space Admin access.
4. Copy the Key ID and Key Secret and enter them into Axonius.

Note: In Spacelift's RBAC system, the Admin toggle on an API key grants it Root Space Admin permissions, equivalent to the Space Admin role on the root space. This is required to access managedUsers and organization-level settings.

---

Option 2: Custom Role (Minimum Permissions)

You can also create a custom role with only the required actions. Assign the custom role to the API key in the root space.

Minimum required actions (from Spacelift RBAC):

Note: Spacelift does not expose granular read-only permissions for managedUsers or org-level API key listing separately from the Admin role. The Space: Admin permission on the root space is the minimum required to access these queries.

---

Creating the API Key

1. Go to Organization Settings → API Keys (requires Admin access).
2. Click Create API key.
3. Give the key a descriptive name (for example, axonius-integration).
4. Enable the Admin toggle.
5. Save the Key ID and Key Secret — the secret is only shown once.

Supported From Version

Supported from Axonius version 9.0.7

Connecting the Adapter in Axonius

1. Navigate to the Adapter Catalog, search for Spacelift, and select the adapter.
2. Click Add Connection.
3. Provide the following parameters.

Required Parameters

1. Spacelift Account URL - The base URL of the Spacelift account. Do not add an endpoint after the domain. Example: https://mycompany.app.spacelift.io
2. API Key ID - The ID of the Spacelift API key.
3. API Key Secret - The secret for the Spacelift API key.

Optional Parameters

1. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.
2. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the Spacelift account URL.
3. HTTPS Proxy User Name - The user name to use when connecting to the Spacelift account URL via the value supplied in HTTPS Proxy.
4. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

• Fetch Application Settings - When enabled, retrieves application settings for audit trail webhooks, API keys, managed users, and stacks. This setting is disabled by default.