Spacelift

Overview

The Spacelift integration connects your Spacelift account to Oneleet. It syncs your users as user account assets and your account as an asset, so Oneleet can monitor who has access to your infrastructure-as-code platform and how they authenticate.

What does Oneleet monitor?

• Spacelift users (user accounts), including each user’s account role and space role bindings, and whether they’re inactive or haven’t accepted their invitation yet
• Your Spacelift account, including whether SSO is configured and whether multi-factor authentication is enforced

Setup

To set up the Spacelift integration, navigate to Integrations > Add integration > Spacelift.

Oneleet connects to the Spacelift GraphQL API with a secret API key. You’ll need admin access to the root space to create the key.

Create an API key

1. In Spacelift, open Organization settings → API keys and click Create API key.
2. Enter a name (e.g. compliance-reader), leave the type as Secret, and click Continue.
3. On the Manage access step, click Add role and select the Space admin role on the root space. Spacelift only lets root space admins list users and read organization settings.
4. Click Create API key. Spacelift downloads a .config file containing the API key ID (api_key_id) and API key secret (api_key_secret).

Spacelift counts API keys as users for billing, so the key uses one seat. Oneleet only reads from Spacelift and never changes your stacks, users, or settings.

Connect to Oneleet

On the integration setup form, enter:

• Account Hostname: from your browser’s address bar, e.g. acme.app.spacelift.io (or acme.app.us.spacelift.io for the US region)
• API Key ID and API Key Secret: from the downloaded .config file

Monitors

Spacelift accounts enforce multi-factor authentication or SSO passes when your account has SSO configured or enforces multi-factor authentication. Both settings require Spacelift’s Enterprise plan, and Spacelift only lets you enforce multi-factor authentication once SSO is set up.