GitLab

GitLab is an open-source version control and collaboration platform. You can bring code projects, packages, repositories, user information, and other security data from GitLab into Brinqa to enhance your organization's security and risk management capabilities, thus strengthening your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with GitLab and how to obtain that information from GitLab. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select GitLab from the Connector dropdown. You must provide the following information to authenticate GitLab with Brinqa:

• ARL: The GitLab API Server URL. The default URL is https://gitlab.com.

• Access token: The access token associated with the GitLab project, which must have permissions to log in to the API server and return data.

Obtain a GitLab access token

For the GitLab connector to access the GitLab API, you must provide a project access token. To obtain an access token, follow these steps:

1. Log in to your organization's GitLab portal as an administrator.

2. Navigate to the GitLab project that you want to integrate into the Brinqa Platform.

3. Navigate to Settings > Access Tokens.

4. Click Add new token.

   Complete the following fields:

   • Token name: Provide a name for the token.

   • Token description: Provide a description for the token.

   • Expiration date: Set an expiry date for the token.

   • Select a role: Click the dropdown and select the Developer role, as this is the minimum level of access required to retrieve data from the GitLab API.

   • Select scopes: Select the following scopes, as these are the minimum scopes required to retrieve data from the GitLab API:

     • read_api
     • read_registry
     • read_repository

     

5. Click Create project access token.

   Your new access token displays. You can not view the token again. Copy and save it to a safe and secure location.

note

If you do not have permissions to create an access token, contact your GitLab administrator. For additional information, see GitLab documentation on Access Tokens, Projects, and Permissions and Roles.

Additional settings

The GitLab connector contains additional options for specific configuration:

• Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.

• Parallel requests: The maximum number of parallel API requests. The default setting is 4.

Types of data to retrieve

The GitLab connector can retrieve the following types of data from the GitLab API:

Table 1: Data retrieved from GitLab

Connector Object	Required	Maps to Data Model
Code Project	Yes	Code Project
Code Repository	Yes	Code Repository
Open Source Finding	Yes	Open Source Finding
Open Source Finding Definition	Yes	Open Source Finding Definition
Package	Yes	Package
Person	Yes	Person
Secret Detection Finding	Yes	Static Code Finding
Secret Detection Finding Definition	Yes	Static Code Finding Definition
Static Code Finding	Yes	Static Code Finding
Static Code Finding Definition	Yes	Static Code Finding Definition

note

For detailed steps on how to view the data retrieved from GitLab in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Code Project

Table 2: Code Project attribute mappings

Source Field Name	SDM Attribute
archived	ARCHIVED
avatarUrl	AVATAR_URL
ciCdSettings.groupRunnersEnabled	GROUP_RUNNERS_ENABLED
ciCdSettings.jobTokenScopeEnabled	CI_JOB_TOKEN_SCOPE_ENABLED
ciCdSettings.keepLatestArtifact	KEEP_LATEST_ARTIFACT
ciConfigPathOrDefault	CI_CONFIG_PATH
containerRegistryEnabled	CONTAINER_REGISTRY_ENABLED
createdAt	SOURCE_CREATED_DATE
Generated (always includes "Code Project")	CATEGORIES
Generated (sync capture timestamp)	LAST_CAPTURED
Generated (set to "active")	SOURCE_STATUS
description	DESCRIPTION
forksCount	FORKS_COUNT
forkingAccessLevel.stringValue	FORKING_ACCESS_LEVEL
fullPath	PATH_WITH_NAMESPACE
httpUrlToRepo	HTTP_URL
id	UID
importStatus	IMPORT_STATUS
issuesAccessLevel.stringValue	ISSUES_ACCESS_LEVEL
issuesEnabled	ISSUES_ENABLED
jobsEnabled	JOBS_ENABLED
labels	LABELS
lastActivityAt	LAST_SEEN
lfsEnabled	LFS_ENABLED
mergeCommitTemplate	MERGE_COMMIT_TEMPLATE
mergeRequestsAccessLevel.stringValue	MERGE_REQUESTS_ACCESS_LEVEL
mergeRequestsEnabled	MERGE_REQUESTS_ENABLED
name	NAME
nameWithNamespace	NAME_WITH_NAMESPACE
namespace	NAMESPACE
onlyAllowMergeIfAllDiscussionsAreResolved	ONLY_ALLOW_MERGE_IF_ALL_DISCUSSIONS_ARE_RESOLVED
onlyAllowMergeIfPipelineSucceeds	ONLY_ALLOW_MERGE_IF_PIPELINE_SUCCEEDS
allowMergeOnSkippedPipeline	ALLOW_MERGE_ON_SKIPPED_PIPELINE
openIssuesCount	OPEN_ISSUES_COUNT
path	PATH
printingMergeRequestLinkEnabled	PRINTING_MERGE_REQUEST_LINK_ENABLED
publicJobs	PUBLIC_JOBS
removeSourceBranchAfterMerge	REMOVE_SOURCE_BRANCH_AFTER_MERGE
repository.rootRef	DEFAULT_BRANCH
requestAccessEnabled	REQUEST_ACCESS_ENABLED
autocloseReferencedIssues	AUTO_CLOSE_REFERENCED_ISSUES
serviceDeskEnabled	SERVICE_DESK_ENABLED
sharedRunnersEnabled	SHARED_RUNNERS_ENABLED
snippetsEnabled	SNIPPETS_ENABLED
squashCommitTemplate	SQUASH_COMMIT_TEMPLATE
sshUrlToRepo	SSH_URL
starCount	STAR_COUNT
suggestionCommitMessage	SUGGESTION_COMMIT_MESSAGE
topics	TAGS
topics	TOPICS
updatedAt	SOURCE_LAST_MODIFIED
visibility	VISIBILITY
webUrl	URL
webUrl	WEB_URL
wikiEnabled	WIKI_ENABLED

Code Repository

Table 3: Code Repository attribute mappings

Source Field Name	SDM Attribute
Generated (includes entry type and "Code Repository")	CATEGORIES
Generated (sync capture timestamp)	LAST_CAPTURED
Generated (set to "active")	STATUS
id	UID
mode	MODE
name	NAME
path	PATH
type	REPO_TYPE

Open Source Finding

Table 4: Open Source Finding attribute mappings

Source Field Name	SDM Attribute
Generated (sync capture timestamp)	LAST_CAPTURED
falsePositive	FALSE_POSITIVE
id	UID
location.file	PATH
location.startLine	LOCATION_START_LINE
location.vulnerableClass	LOCATION_CLASS
location.vulnerableMethod	LOCATION_METHOD
normalizeFindingStatus(state)	SOURCE_STATUS
project.id	TARGETS
scanner.externalId	SCANNER_EXTERNAL_ID
scanner.name	SCANNER_NAME
scanner.vendor	SCANNER_VENDOR
state	PROVIDER_STATUS
title	TYPE

Open Source Finding Definition

Table 5: Open Source Finding Definition attribute mappings

Source Field Name	SDM Attribute
Generated (sync capture timestamp)	LAST_CAPTURED
description	DESCRIPTION
identifiers[].externalId (where externalType=cve)	CVE_IDS
identifiers[].externalId (where externalType=cve)	CVE_RECORDS
identifiers[].externalId (where externalType=cwe)	CWE_IDS
identifiers[].externalId (where externalType=cwe)	WEAKNESSES
normalizeFindingSeverity(severity)	SEVERITY
reportType	CATEGORIES
severity	SOURCE_SEVERITY
getFindingSeverityScore(severity)	SEVERITY_SCORE
solution	RECOMMENDATION
title	NAME
title	UID

Package

Table 6: Package attribute mappings

Source Field Name	SDM Attribute
_links.webPath	LINKS_WEB_PATH
createdAt	SOURCE_CREATED_DATE
Generated (sync capture timestamp)	LAST_CAPTURED
id	UID
name	NAME
normalizeAssetStatus(status)	SOURCE_STATUS
packageType	CATEGORIES
pipeline.createdAt	PIPELINE_CREATED_AT
pipeline.iid	PIPELINE_IID
pipeline.projectId	PIPELINE_PROJECT_ID
pipeline.ref	PIPELINE_REF
pipeline.sha	PIPELINE_SHA
pipeline.source	PIPELINE_SOURCE
pipeline.status	PIPELINE_STATUS
pipeline.user.username	PIPELINE_USERNAME
pipelines	PIPELINES
pipelines.id	PIPELINE_ID
pipelines.updatedAt	PIPELINE_UPDATED_AT
pipelines.user.id	PIPELINE_USER_ID
status	PACKAGE_STATUS
tags	TAGS
version	LATEST_VERSION

Person

Table 7: Person attribute mappings

Source Field Name	SDM Attribute
accessLevel.integerValue	ACCESS_LEVEL
createdAt	SOURCE_CREATED_DATE
createdBy.id	CREATED_BY
createdBy.username	OWNER
expiresAt	EXPIRES_AT
Generated (sync capture timestamp)	LAST_CAPTURED
membershipState	MEMBERSHIP_STATE
user.avatarUrl	AVATAR_URL
user.id	UID
user.name	NAME
user.state	STATE
user.username	USERNAME
user.webUrl	WEB_URL

Secret Detection Finding

Table 8: Secret Detection Finding attribute mappings

Source Field Name	SDM Attribute
Generated (sync capture timestamp)	LAST_CAPTURED
falsePositive	FALSE_POSITIVE
id	UID
location.file	PATH
location.startLine	LOCATION_START_LINE
location.vulnerableClass	LOCATION_CLASS
location.vulnerableMethod	LOCATION_METHOD
normalizeFindingStatus(state)	SOURCE_STATUS
project.id	TARGETS
scanner.externalId	SCANNER_EXTERNAL_ID
scanner.name	SCANNER_NAME
scanner.vendor	SCANNER_VENDOR
state	PROVIDER_STATUS
title	TYPE

Secret Detection Finding Definition

Table 9: Secret Detection Finding Definition attribute mappings

Source Field Name	SDM Attribute
Generated (sync capture timestamp)	LAST_CAPTURED
description	DESCRIPTION
identifiers[].externalId (where externalType=cve)	CVE_IDS
identifiers[].externalId (where externalType=cve)	CVE_RECORDS
identifiers[].externalId (where externalType=cwe)	CWE_IDS
identifiers[].externalId (where externalType=cwe)	WEAKNESSES
normalizeFindingSeverity(severity)	SEVERITY
reportType	CATEGORIES
severity	SOURCE_SEVERITY
getFindingSeverityScore(severity)	SEVERITY_SCORE
solution	RECOMMENDATION
title	NAME
title	UID

Static Code Finding

Table 10: Static Code Finding attribute mappings

Source Field Name	SDM Attribute
Generated (sync capture timestamp)	LAST_CAPTURED
falsePositive	FALSE_POSITIVE
id	UID
location.file	PATH
location.startLine	LOCATION_START_LINE
location.vulnerableClass	LOCATION_CLASS
location.vulnerableMethod	LOCATION_METHOD
normalizeFindingStatus(state)	SOURCE_STATUS
project.id	TARGETS
scanner.externalId	SCANNER_EXTERNAL_ID
scanner.name	SCANNER_NAME
scanner.vendor	SCANNER_VENDOR
state	PROVIDER_STATUS
title	TYPE

Static Code Finding Definition

Table 11: Static Code Finding Definition attribute mappings

Source Field Name	SDM Attribute
Generated (sync capture timestamp)	LAST_CAPTURED
description	DESCRIPTION
identifiers[].externalId (where externalType=cve)	CVE_IDS
identifiers[].externalId (where externalType=cve)	CVE_RECORDS
identifiers[].externalId (where externalType=cwe)	CWE_IDS
identifiers[].externalId (where externalType=cwe)	WEAKNESSES
normalizeFindingSeverity(severity)	SEVERITY
reportType	CATEGORIES
severity	SOURCE_SEVERITY
getFindingSeverityScore(severity)	SEVERITY_SCORE
solution	RECOMMENDATION
title	NAME
title	UID

info

Local variable indicates that the field is processed within a specific context, such as a particular workflow or calculation. Unlike other attributes, local variables aren't mapped to the unified data models. They only exist on the source data model.

Operation options

The GitLab connector supports the following operation options. See connector operation options for information about how to apply them.

Table 12: GitLab connector operation options

Connector Object	Option	All Possible Values	Description	Example
Code Project	visibility	public, internal, private	Filter retrieved code projects by their visibility level, as determined by GitLab.	Key: visibility Value: private. This key and value combination only retrieves private code projects.
Code Repository	path	Any code repository path	Limit the retrieval of code repositories from the specified path within the repository.	Key: path Value: src/main. This key and value combination only retrieves code repositories within the src/main path.
	recursive	true, false	Recurse into subdirectories when retrieving repository content.	Key: recursive Value: true. This key and value combination retrieves the content recursively within all subdirectories.
	ref	Any code repository branch or tag name	Specify the Git ref (branch or tag) to retrieve repository content from.	Key: ref Value: main. This key and value combination retrieves code repositories from the main branch.
Open Source Finding, Open Source Finding Definition	projectFullPath	Comma-separated list of GitLab project full paths	Scope finding sync to only the specified projects, bypassing full project enumeration.	Key: projectFullPath Value: my-group/my-project, my-group/other-project. This key and value combination only retrieves findings from the specified projects.
	severity	INFO, UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL	Filter retrieved vulnerabilities by severity level.	Key: severity Value: HIGH,CRITICAL. This key and value combination only retrieves high and critical vulnerabilities.
Package	status	DEFAULT, HIDDEN, PROCESSING, ERROR, PENDING_DESTRUCTION	Filter retrieved packages by their status, as determined by GitLab.	Key: status Value: DEFAULT. This key and value combination only retrieves packages with the default status.
Secret Detection Finding, Secret Detection Finding Definition	projectFullPath	Comma-separated list of GitLab project full paths	Scope secret detection finding sync to only the specified projects, bypassing full project enumeration.	Key: projectFullPath Value: my-group/my-project. This key and value combination only retrieves secret detection findings from the specified project.
	severity	INFO, UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL	Filter retrieved secret detection vulnerabilities by severity level.	Key: severity Value: HIGH,CRITICAL. This key and value combination only retrieves high and critical secret detection vulnerabilities.
Static Code Finding, Static Code Finding Definition	projectFullPath	Comma-separated list of GitLab project full paths	Scope SAST finding sync to only the specified projects, bypassing full project enumeration.	Key: projectFullPath Value: my-group/my-project. This key and value combination only retrieves SAST findings from the specified project.
	severity	INFO, UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL	Filter retrieved SAST vulnerabilities by severity level.	Key: severity Value: HIGH,CRITICAL. This key and value combination only retrieves high and critical SAST vulnerabilities.

note

The option keys and values are case-sensitive as they are shown in this documentation.

APIs

The GitLab connector uses the GitLab GraphQL API. Specifically, it uses the following endpoint:

Table 13: GitLab API Endpoints

Connector Object	API Endpoint
Code Project	POST /api/graphql
Code Repository	POST /api/graphql
Open Source Finding	POST /api/graphql
Open Source Finding Definition	POST /api/graphql
Package	POST /api/graphql
Person	POST /api/graphql
Secret Detection Finding	POST /api/graphql
Secret Detection Finding Definition	POST /api/graphql
Static Code Finding	POST /api/graphql
Static Code Finding Definition	POST /api/graphql

Changelog

The GitLab connector has undergone the following changes:

Table 14: GitLab connector changelog

Version	Description	Date Published
3.1.2	Improvements - Custom attributes on the Code Project and Package models now register with the correct cross-connector consolidation priority (via the shared attribute helper), so connector-sourced values are consolidated consistently rather than treated as independent. Bug Fixes - Corrected the Package model's pipeline ID attributes ("Pipeline ID", "Pipeline project ID", "Pipeline user id") from numbers to text. GitLab returns these IDs as strings, so writing them into numeric attributes caused the Package sync to fail with an attribute type mismatch whenever a package had an associated pipeline. ("Pipeline IID" is genuinely numeric and is unchanged.) Migration Required - 'Package': the "Pipeline ID", "Pipeline project ID", and "Pipeline user id" attributes changed from numbers to text. Re-sync the GitLab connector to repopulate packages with the corrected type.	June 9th, 2026
3.1.1	Added support for secret detection findings. The connector can now independently synchronize GitLab secret detection vulnerabilities as separate Secret Detection Finding and Secret Detection Finding Definition models. No migration required.	May 27th, 2026
3.0.2	Added the LABELS attribute to the Code Project object.	November 30th, 2024
3.0.1	Changed the CREATED_BY attribute type on the Person object from integer to string.	August 15th, 2024
3.0.0	Initial Integration+ release.	July 17th, 2024