Integrations

What this is for

Settings → Integrations is the catalog of third-party connections for your organization. Each integration is a card on a searchable hub; clicking View integration opens a two-step dialog — Overview (what the connector does) and Connect (credentials and Test & Connect). Available today:

GitHub — AI-dependency discovery for Discovery.
Azure AI Foundry and Amazon Bedrock — cloud agent inventory for Agents and Topology.
Microsoft Entra ID — identity hydration and expanded ASI03 findings on agents (no separate agent list).

Integrations are platform-scoped — configure once per organization, not per gateway.

The integrations hub

Search and filters

Element	Notes
Search integrations…	Filters cards by name, tagline, category, or slug.
All	Shows every integration (default).
Source control	GitHub, GitLab (soon).
Identity & access	Microsoft Entra ID, Okta (soon).
Collaboration & work	Slack, Jira (soon).
Cloud AI platforms	Azure AI Foundry, Amazon Bedrock.

Card states

Badge	Meaning
Connected	Integration is active (GitHub PAT, Foundry SP, Bedrock IAM key, or Entra Active).
Connect	Available but not yet configured (e.g. Amazon Bedrock).
Soon	On the roadmap (Okta, Slack, Jira, GitLab).

Each card shows the integration name, one-line tagline, and View integration.

Integrations catalog with category filters — Settings → Integrations hub

Integration dialog

Every View integration opens the same dialog shell:

Element	Notes
Step pills	OVERVIEW then CONNECT. Use Next and Cancel in the footer.
Overview	Tagline, feature checklist, capability cards, Works with badges, Category chip, Free label.
Connect	Integration-specific fields and Test & Connect (or Test Microsoft Graph access for Entra). Connected integrations show Resync and Disconnect where applicable.

Deep links: opening ?open=<slug> on the integrations route selects the card automatically (azure-foundry, aws-bedrock, entra-id, github).

Azure AI Foundry integration dialog on Overview step — Integration dialog — Overview step (Azure AI Foundry)

GitHub

Field	Required	Notes
Personal Access Token	Yes	Classic PAT with `repo` and `read:org`. Password field, placeholder `ghp_...`.

Connection state

Element	Notes
Status badge	`Connected` or `Disconnected`.
Metadata	Username and `connected_at`.
Test & Connect	Validates the PAT; toast Invalid token on failure.
Disconnect	Revokes the token.

Limits

One GitHub PAT per organization.
Used for Discovery only — no per-repo routing.

How to configure (GitHub)

Open the GitHub card

Settings → Integrations → GitHub → View integration → Next to Connect.

Create a PAT

On github.com/settings/tokens, create a classic token with repo and read:org.

Test & Connect

Paste the PAT and click Test & Connect. The hub card shows Connected.

Verify in Discovery

Open Discovery → Repositories.

Disconnecting stops discovery scans. Reconnecting requires a new PAT.

Azure AI Foundry

Field	Required	Notes
Tenant ID	Yes	Entra tenant GUID.
Subscription ID	Yes	Subscription with AI Foundry resources.
Client (App) ID	Yes	Service Principal application id.
Client Secret	Yes	Secret Value (not Secret ID). Encrypted at rest.

Read-only Service Principal — lists agents, tools, MCP servers, and models.

Connection state

Element	Notes
Status badge	`Connected` or `Disconnected`.
Metadata	Subscription label and connection date.
Test & Connect	Authenticates before save.
Resync	Immediate discovery refresh for Agents.
Disconnect	Removes credentials and discovered inventory for that subscription.

Limits

One Azure subscription per organization in v1.
Data-plane role required at AI Services account scope (see permissions below).

How to configure (Azure AI Foundry)

Azure AI Foundry — Connect step

App registrations → New registration (single tenant, no redirect URI). Copy Application (client) ID.

Create a client secret

Certificates & secrets → copy the secret Value immediately.

Grant subscription Reader

Subscriptions → IAM → Reader (or Azure AI Developer) for the SP.

Grant account-scoped data-plane access

On each AI Services account → IAM → Azure AI User or Azure AI Developer for the SP. Subscription-level alone returns 401 on agent APIs.

Connect in Guardway

View integration → Connect → paste four fields → Test & Connect.

Verify agents

Open Agents or Dashboard → Agents. Use Resync after adding projects.

Required Azure permissions

Capability	Plane	Role	Scope
List subscription / resource groups	Management	Reader	Subscription
List AI Services accounts	Management	Reader or Azure AI Developer	Subscription
Read agents, tools, MCP	Data	Azure AI User or Azure AI Developer	AI Services account

Microsoft Entra ID

Field	Required	Notes
(none)	—	Reuses the Service Principal from Azure AI Foundry. Grant Microsoft Graph application permissions on the same app registration.

Connection state

Element	Notes
Status badge	`Active`, `Pending consent`, `Disconnected`, or `Error`.
Service Principal banner	Shown when Foundry is not connected; Connect Azure AI Foundry button.
Test Microsoft Graph access	Reports Granted vs Still need admin consent; flips to Active when required scopes are present.
Last identity sync	Shown when Active and at least one sync completed.

Required Microsoft Graph permissions

Scope	Required	Unlocks
`Application.Read.All`	Yes	Credential lifecycle rules.
`Directory.Read.All`	Yes	Principals, owners, grants, directory roles.
`AuditLog.Read.All`	No	`asi03.dormant_principal` (needs AAD Premium P1/P2).

Limits

One tenant (same as Foundry SP).
Identity sync chains after Foundry Resync — no separate Entra Resync button yet.

How to configure (Microsoft Entra ID)

Microsoft Entra ID — Connect step

Connect Azure AI Foundry first

Entra reuses that Service Principal.

Grant Graph admin consent

App registrations → your SP → API permissions → add the three Graph application permissions → Grant admin consent.

Test Microsoft Graph access

On the Entra Connect step, click Test Microsoft Graph access until both required scopes show Granted and status is Active.

Resync Foundry

Azure AI Foundry → Resync chains identity sync. Open an agent detail page to see Identities.

Amazon Bedrock

Field	Required	Notes
Access Key ID	Yes	IAM access key (`AKIA…`).
Secret Access Key	Yes	Matching secret (password field).
Region	Yes	Bedrock region (e.g. `us-east-1`). One region per integration.

Read-only — lists Bedrock Agents, action groups, knowledge bases, models, and referenced guardrails.

Connection state

Element	Notes
Status badge	`Connected` or `Disconnected`.
Metadata	Account label (e.g. `AWS account 123456789012 / us-east-1`) and connection date.
Test & Connect	Validates via STS before save.
Resync	Immediate refresh for Agents.
Disconnect	Removes credentials and Bedrock inventory for that account and region.

Limits

One AWS account + region per organization in v1.
No MCP servers on Bedrock agents (MCP column stays empty).
Guardrails referenced by agents appear as metadata only.

Required AWS IAM permissions

Capability	Action(s)
Verify credentials	`sts:GetCallerIdentity`
List/read agents and action groups	`bedrock:ListAgents`, `bedrock:GetAgent`, `bedrock:ListAgentActionGroups`, `bedrock:GetAgentActionGroup`
Knowledge bases	`bedrock:ListAgentKnowledgeBases`, `bedrock:ListKnowledgeBases`
Guardrails	`bedrock:ListGuardrails`

AWS managed AmazonBedrockReadOnly plus sts:GetCallerIdentity (or ReadOnlyAccess).

How to configure (Amazon Bedrock)

Amazon Bedrock — Connect step

Create an IAM user

Programmatic access only (e.g. guardway-cloud-agent-discovery).

Attach policies

AmazonBedrockReadOnly and inline sts:GetCallerIdentity on *.

Create access key

Copy Access key ID and Secret access key (secret shown once).

Connect in Guardway

View integration → Connect → paste three fields → Test & Connect.

Verify agents

Open Agents. Use Resync after adding agents in AWS.

Coming soon

Hub cards marked Soon: Okta, Slack, Jira, GitLab. Email support@guardway.ai to prioritize one.

Agents — inventory and findings.
Dashboard → Agents — org-wide agent metrics.
Topology — gateway → provider → model → agent graph.
Discovery — GitHub-powered repository scans.

Getting Started

Platform

Gateway

Discovery

Resources

API Reference

What this is for

The integrations hub

Search and filters

Card states

Integration dialog

GitHub

Connection state

Limits

How to configure (GitHub)

Azure AI Foundry

Connection state

Limits

How to configure (Azure AI Foundry)

Required Azure permissions

Microsoft Entra ID

Connection state

Required Microsoft Graph permissions

Limits

How to configure (Microsoft Entra ID)

Amazon Bedrock

Connection state

Limits

Required AWS IAM permissions

How to configure (Amazon Bedrock)

Coming soon

​What this is for

​The integrations hub

​Search and filters

​Card states

​Integration dialog

​GitHub

​Connection state

​Limits

​How to configure (GitHub)

​Azure AI Foundry

​Connection state

​Limits

​How to configure (Azure AI Foundry)

​Required Azure permissions

​Microsoft Entra ID

​Connection state

​Required Microsoft Graph permissions

​Limits

​How to configure (Microsoft Entra ID)

​Amazon Bedrock

​Connection state

​Limits

​Required AWS IAM permissions

​How to configure (Amazon Bedrock)

​Coming soon

​Related

What this is for

The integrations hub

Search and filters

Card states

Integration dialog

GitHub

Connection state

Limits

How to configure (GitHub)

Azure AI Foundry

Connection state

Limits

How to configure (Azure AI Foundry)

Required Azure permissions

Microsoft Entra ID

Connection state

Required Microsoft Graph permissions

Limits

How to configure (Microsoft Entra ID)

Amazon Bedrock

Connection state

Limits

Required AWS IAM permissions

How to configure (Amazon Bedrock)

Coming soon

Related