GitLab

Application Security

Overview

The GitLab connector integrates with the GitLab DevSecOps platform to synchronize security and asset data. It connects via the GitLab GraphQL API to fetch projects, repositories, packages, users, and vulnerability findings (SAST, dependency scanning, and secret detection).

Data retrieved from GitLab

Connector Object	Required	Maps to Data Model
Code Project	Yes	Code Project
Code Repository	Yes	Code Repository
Package	Yes	Package
Person	Yes	Person
Static Code Finding	Yes	Static Code Finding
Static Code Finding Definition	Yes	Static Code Finding Definition
Secret Detection Finding	Yes	Static Code Finding
Secret Detection Finding Definition	Yes	Static Code Finding Definition
Open Source Finding	Yes	Open Source Finding
Open Source Finding Definition	Yes	Open Source Finding Definition

Model relationships

note

For detailed steps on how to view the data retrieved from GitLab in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select GitLab from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	No	https://gitlab.com	The GitLab API server URL.
Access token	Yes	—	GitLab personal access token
Page size	No	100	Maximum number of records to get per API request
Custom Headers	No	—	Custom HTTP headers to include with every request (format: HeaderName=HeaderValue)
Parallel requests	No	min(4, cores)	Maximum number of parallel API requests per model sync
Security attribute group path	No	—	Optional. Comma-separated full paths of top-level groups whose security attribute categories become selectable SECURITY_ATTRIBUTE_ columns on Code Project (for example "macys-root,acme-root"). Leave blank to discover categories across all top-level groups the access token belongs to. Requires GitLab Ultimate; ignored on instances without security attributes.

How to obtain GitLab credentials

For the GitLab connector to access the GitLab API, provide a project access token (a personal access token with the same scopes also works). To create a project access token, follow these steps:

1. In GitLab, open the project you want to integrate, then go to Settings > Access tokens.

2. Select Add new token.

3. Enter a Token name, an optional description, and an Expiration date.

4. Set the role to Developer. This is the minimum role that can read security findings; lower roles can read code, packages, and members but not vulnerabilities.

5. Select the following scopes:

   • read_api: Read access to the GraphQL API, including packages and security findings.
   • read_repository: Read access to repository files and trees.

6. Select Create project access token, then copy and store the token securely. You cannot view it again.

note

Creating a project access token requires the Maintainer or Owner role, and you cannot assign a token a role higher than your own. If you do not have permission, contact your GitLab administrator. See the GitLab documentation on project access tokens, access token scopes, and roles and permissions.

info

Reading SAST, secret detection, and dependency scanning findings requires GitLab Ultimate. On other tiers, the connector still syncs code projects, repositories, packages, and members, but security findings return empty.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Code Project

Source Field Name	SDM Attribute
allowMergeOnSkippedPipeline	ALLOW_MERGE_ON_SKIPPED_PIPELINE
archived	ARCHIVED
autocloseReferencedIssues	AUTO_CLOSE_REFERENCED_ISSUES
avatarUrl	AVATAR_URL
ciCdSettings.groupRunnersEnabled	GROUP_RUNNERS_ENABLED
ciCdSettings.jobTokenScopeEnabled	CI_JOB_TOKEN_SCOPE_ENABLED
ciCdSettings.keepLatestArtifact	KEEP_LATEST_ARTIFACT
ciConfigPathOrDefault	CI_CONFIG_PATH
containerRegistryEnabled	CONTAINER_REGISTRY_ENABLED
createdAt	SOURCE_CREATED_DATE
description	DESCRIPTION
forkingAccessLevel.stringValue	FORKING_ACCESS_LEVEL
forksCount	FORKS_COUNT
fullPath	PATH_WITH_NAMESPACE
Generated ("active")	SOURCE_STATUS
Generated (always includes "code project")	CATEGORIES
Generated (captured once at sync start)	LAST_CAPTURED
httpUrlToRepo	HTTP_URL
id	UID
importStatus	IMPORT_STATUS
issuesAccessLevel.stringValue	ISSUES_ACCESS_LEVEL
issuesEnabled	ISSUES_ENABLED
jobsEnabled	JOBS_ENABLED
labels	LABELS
lastActivityAt	LAST_SEEN
lfsEnabled	LFS_ENABLED
mergeCommitTemplate	MERGE_COMMIT_TEMPLATE
mergeRequestsAccessLevel.stringValue	MERGE_REQUESTS_ACCESS_LEVEL
mergeRequestsEnabled	MERGE_REQUESTS_ENABLED
name	NAME
namespace	NAMESPACE
namespace.rootNamespace.fullPath	TOP_LEVEL_GROUP_FULL_PATH
namespace.rootNamespace.id	TOP_LEVEL_GROUP_ID
namespace.rootNamespace.name	TOP_LEVEL_GROUP_NAME
namespace.rootNamespace.webUrl	TOP_LEVEL_GROUP_WEB_URL
nameWithNamespace	NAME_WITH_NAMESPACE
onlyAllowMergeIfAllDiscussionsAreResolved	ONLY_ALLOW_MERGE_IF_ALL_DISCUSSIONS_ARE_RESOLVED
onlyAllowMergeIfPipelineSucceeds	ONLY_ALLOW_MERGE_IF_PIPELINE_SUCCEEDS
openIssuesCount	OPEN_ISSUES_COUNT
path	PATH
printingMergeRequestLinkEnabled	PRINTING_MERGE_REQUEST_LINK_ENABLED
publicJobs	PUBLIC_JOBS
removeSourceBranchAfterMerge	REMOVE_SOURCE_BRANCH_AFTER_MERGE
repository.rootRef	DEFAULT_BRANCH
requestAccessEnabled	REQUEST_ACCESS_ENABLED
securityAttributes[]	SECURITY_ATTRIBUTE_{CATEGORY}
serviceDeskEnabled	SERVICE_DESK_ENABLED
sharedRunnersEnabled	SHARED_RUNNERS_ENABLED
snippetsEnabled	SNIPPETS_ENABLED
squashCommitTemplate	SQUASH_COMMIT_TEMPLATE
sshUrlToRepo	SSH_URL
starCount	STAR_COUNT
suggestionCommitMessage	SUGGESTION_COMMIT_MESSAGE
topics	TAGS
topics	TOPICS
updatedAt	SOURCE_LAST_MODIFIED
visibility	VISIBILITY
webUrl	URL
webUrl	WEB_URL
wikiEnabled	WIKI_ENABLED

Code Repository

Source Field Name	SDM Attribute
Generated (always set to "active")	STATUS
Generated (captured once at sync start)	LAST_CAPTURED
Generated (includes entry type and "code repository")	CATEGORIES
id	UID
mode	MODE
name	NAME
path	PATH
type	REPO_TYPE

Package

Source Field Name	SDM Attribute
_links.webPath	LINKS_WEB_PATH
createdAt	SOURCE_CREATED_DATE
Generated (captured once at sync start)	LAST_CAPTURED
id	UID
name	NAME
normalizeAssetStatus(status)	SOURCE_STATUS
packageType	CATEGORIES
pipeline.createdAt	PIPELINE_CREATED_AT
pipeline.iid	PIPELINE_IID
pipeline.projectId	PIPELINE_PROJECT_ID
pipeline.ref	PIPELINE_REF
pipeline.sha	PIPELINE_SHA
pipeline.source	PIPELINE_SOURCE
pipeline.status	PIPELINE_STATUS
pipeline.user.username	PIPELINE_USERNAME
pipelines	PIPELINES
pipelines.id	PIPELINE_ID
pipelines.updatedAt	PIPELINE_UPDATED_AT
pipelines.user.id	PIPELINE_USER_ID
status	PACKAGE_STATUS
tags	TAGS
version	LATEST_VERSION

Person

Source Field Name	SDM Attribute
accessLevel.integerValue	ACCESS_LEVEL
createdAt	SOURCE_CREATED_DATE
createdBy.id	CREATED_BY
createdBy.username	OWNER
expiresAt	EXPIRES_AT
Generated (captured once at sync start)	LAST_CAPTURED
membershipState	MEMBERSHIP_STATE
user.avatarUrl	AVATAR_URL
user.id	UID
user.name	NAME
user.state	STATE
user.username	USERNAME
user.webUrl	WEB_URL

Static Code Finding

Source Field Name	SDM Attribute
falsePositive	FALSE_POSITIVE
Generated (captured once at sync start)	LAST_CAPTURED
id	UID
location.file	PATH
location.startLine	LOCATION_START_LINE
location.vulnerableClass	LOCATION_CLASS
location.vulnerableMethod	LOCATION_METHOD
normalizeFindingStatus(state)	SOURCE_STATUS
project.id	TARGETS
scanner.externalId	SCANNER_EXTERNAL_ID
scanner.name	SCANNER_NAME
scanner.vendor	SCANNER_VENDOR
state	PROVIDER_STATUS
title	TYPE

Static Code Finding Definition

Source Field Name	SDM Attribute
description	DESCRIPTION
Generated (captured once at sync start)	LAST_CAPTURED
Generated (cve record correlation (same values as cve_ids))	CVE_RECORDS
Generated (unique definition identifier (keyed by vulnerability title))	UID
Generated (weakness correlation (same values as cwe_ids))	WEAKNESSES
getFindingSeverityScore(severity)	SEVERITY_SCORE
identifiers[].externalId (where externalType=cve)	CVE_IDS
identifiers[].externalId (where externalType=cwe)	CWE_IDS
normalizeFindingSeverity(severity)	SEVERITY
reportType	CATEGORIES
severity	SOURCE_SEVERITY
solution	RECOMMENDATION
title	NAME

Secret Detection Finding

Source Field Name	SDM Attribute
falsePositive	FALSE_POSITIVE
Generated (captured once at sync start)	LAST_CAPTURED
id	UID
location.file	PATH
location.startLine	LOCATION_START_LINE
location.vulnerableClass	LOCATION_CLASS
location.vulnerableMethod	LOCATION_METHOD
normalizeFindingStatus(state)	SOURCE_STATUS
project.id	TARGETS
scanner.externalId	SCANNER_EXTERNAL_ID
scanner.name	SCANNER_NAME
scanner.vendor	SCANNER_VENDOR
state	PROVIDER_STATUS
title	TYPE

Secret Detection Finding Definition

Source Field Name	SDM Attribute
description	DESCRIPTION
Generated (captured once at sync start)	LAST_CAPTURED
Generated (CVE record correlation, same values as CVE_IDS)	CVE_RECORDS
Generated (unique definition identifier, keyed by vulnerability title)	UID
Generated (weakness correlation, same values as CWE_IDS)	WEAKNESSES
getFindingSeverityScore(severity)	SEVERITY_SCORE
identifiers[].externalId (where externalType=cve)	CVE_IDS
identifiers[].externalId (where externalType=cwe)	CWE_IDS
normalizeFindingSeverity(severity)	SEVERITY
reportType	CATEGORIES
severity	SOURCE_SEVERITY
solution	RECOMMENDATION
title	NAME

Open Source Finding

Source Field Name	SDM Attribute
falsePositive	FALSE_POSITIVE
Generated (captured once at sync start)	LAST_CAPTURED
id	UID
location.file	PATH
location.startLine	LOCATION_START_LINE
location.vulnerableClass	LOCATION_CLASS
location.vulnerableMethod	LOCATION_METHOD
normalizeFindingStatus(state)	SOURCE_STATUS
project.id	TARGETS
scanner.externalId	SCANNER_EXTERNAL_ID
scanner.name	SCANNER_NAME
scanner.vendor	SCANNER_VENDOR
state	PROVIDER_STATUS
title	TYPE

Open Source Finding Definition

Source Field Name	SDM Attribute
description	DESCRIPTION
Generated (captured once at sync start)	LAST_CAPTURED
Generated (CVE record correlation, same values as CVE_IDS)	CVE_RECORDS
Generated (unique definition identifier, keyed by vulnerability title)	UID
Generated (weakness correlation, same values as CWE_IDS)	WEAKNESSES
getFindingSeverityScore(severity)	SEVERITY_SCORE
identifiers[].externalId (where externalType=cve)	CVE_IDS
identifiers[].externalId (where externalType=cwe)	CWE_IDS
normalizeFindingSeverity(severity)	SEVERITY
reportType	CATEGORIES
severity	SOURCE_SEVERITY
solution	RECOMMENDATION
title	NAME

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Code Project

Operation options

Option	Type	Default	Description
visibility	String	—	Filter by visibility (public, internal, private)

Delta sync

Not supported. The connector performs a full sync of Code Project on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /api/graphql
• Default filters: membership: true

query($first: Int!, $after: String, $membership: Boolean, $visibilityLevel: VisibilityLevelsEnum) {
  page: projects(first: $first, after: $after, membership: $membership, visibilityLevel: $visibilityLevel) {
    pageInfo { endCursor hasNextPage }
    nodes {
      id name description path
      nameWithNamespace
      fullPath
      createdAt updatedAt lastActivityAt
      visibility archived
      topics
      sshUrlToRepo httpUrlToRepo webUrl
      avatarUrl
      forksCount starCount
      namespace { id name path fullPath webUrl rootNamespace { id name fullPath webUrl } }
      repository { exists rootRef }
      issuesEnabled mergeRequestsEnabled wikiEnabled
      snippetsEnabled serviceDeskEnabled
      containerRegistryEnabled jobsEnabled
      lfsEnabled sharedRunnersEnabled publicJobs
      openIssuesCount importStatus
      onlyAllowMergeIfPipelineSucceeds
      onlyAllowMergeIfAllDiscussionsAreResolved
      allowMergeOnSkippedPipeline
      requestAccessEnabled
      removeSourceBranchAfterMerge
      printingMergeRequestLinkEnabled
      autocloseReferencedIssues
      mergeCommitTemplate squashCommitTemplate
      suggestionCommitMessage
      ciConfigPathOrDefault
      forkingAccessLevel { stringValue }
      issuesAccessLevel { stringValue }
      mergeRequestsAccessLevel { stringValue }
      ciCdSettings {
        groupRunnersEnabled keepLatestArtifact
        jobTokenScopeEnabled
      }
      labels { nodes { title color } }
      securityAttributes { nodes { id name securityCategory { name } } }
    }
  }
}

Code Repository

Operation options

Option	Type	Default	Description
ref	String	—	Git ref (branch/tag)
path	String	—	Path within repository
recursive	Boolean	—	Recurse into subdirectories

Delta sync

Not supported. The connector performs a full sync of Code Repository on every run and applies no incremental date filter.

API

• Type: GraphQL query (two queries per project: trees + blobs) · Endpoint: POST /api/graphql

query($fullPath: ID!, $first: Int!, $after: String, $ref: String, $path: String, $recursive: Boolean) {
  project(fullPath: $fullPath) {
    repository {
      tree(ref: $ref, path: $path, recursive: $recursive) {
        page: trees(first: $first, after: $after) {
          pageInfo { endCursor hasNextPage }
          nodes { id name path type flatPath }
        }
      }
    }
  }
}

Package

Operation options

Option	Type	Default	Description
status	String	—	Filter by status (DEFAULT, HIDDEN, PROCESSING, ERROR, PENDING_DESTRUCTION)

Delta sync

Not supported. The connector performs a full sync of Package on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /api/graphql

query($fullPath: ID!, $first: Int!, $after: String, $status: PackageStatus) {
  project(fullPath: $fullPath) {
    page: packages(first: $first, after: $after, status: $status) {
      pageInfo { endCursor hasNextPage }
      nodes {
        id name version packageType status
        createdAt
        _links { webPath }
        tags { nodes { name } }
        pipelines {
          nodes {
            id iid sha ref status source createdAt updatedAt
            project { id }
            user { id username }
          }
        }
      }
    }
  }
}

Person

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Person on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /api/graphql

query($fullPath: ID!, $first: Int!, $after: String) {
  project(fullPath: $fullPath) {
    page: projectMembers(first: $first, after: $after) {
      pageInfo { endCursor hasNextPage }
      nodes {
        id accessLevel { integerValue stringValue }
        createdAt expiresAt
        user { id name username state webUrl avatarUrl }
        createdBy { id username }
      }
    }
  }
}

Static Code Finding

Operation options

Option	Type	Default	Description
severity	String	—	Filter by severity (INFO, UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL)
projectFullPath	String	—	Comma-separated list of GitLab project full paths (e.g., my-group/my-project, my-group/other-project). When set, finding sync is scoped to only the specified projects, bypassing full project enumeration.

Delta sync

Not supported. The connector performs a full sync of Static Code Finding on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /api/graphql
• Default filters: reportType: [SAST]

query($fullPath: ID!, $first: Int!, $after: String, $reportType: [VulnerabilityReportType!], $severity: [VulnerabilitySeverity!]) {
  project(fullPath: $fullPath) {
    page: vulnerabilities(first: $first, after: $after, reportType: $reportType, severity: $severity) {
      pageInfo { endCursor hasNextPage }
      nodes {
        id title state severity reportType
        scanner { externalId name vendor }
        identifiers { name url externalId externalType }
        project { id name fullPath }
        location {
          ... on VulnerabilityLocationSast {
            file startLine vulnerableClass vulnerableMethod
          }
          ... on VulnerabilityLocationDependencyScanning {
            file dependency { package { name } version }
          }
          ... on VulnerabilityLocationSecretDetection {
            file startLine
          }
        }
        description solution falsePositive
      }
    }
  }
}

Static Code Finding Definition

Operation options

Option	Type	Default	Description
severity	String	—	Filter by severity
projectFullPath	String	—	Comma-separated list of GitLab project full paths. When set, scopes finding definition sync to only the specified projects.

Delta sync

Not supported. The connector performs a full sync of Static Code Finding Definition on every run and applies no incremental date filter.

API

• Type: GraphQL query (reuses Static Code Finding vulnerability data, de-duplicated by name) · Endpoint: POST /api/graphql
• Default filters: reportType: [SAST]
• Query: Same as Static Code Finding, de-duplicated by name.

Secret Detection Finding

Operation options

Option	Type	Default	Description
severity	String	—	Filter by severity (INFO, UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL)
projectFullPath	String	—	Comma-separated list of GitLab project full paths (e.g., my-group/my-project, my-group/other-project). When set, finding sync is scoped to only the specified projects, bypassing full project enumeration.

Delta sync

Not supported. The connector performs a full sync of Secret Detection Finding on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /api/graphql
• Default filters: reportType: [SECRET_DETECTION]
• Query: Same as Static Code Finding.

Secret Detection Finding Definition

Operation options

Option	Type	Default	Description
severity	String	—	Filter by severity
projectFullPath	String	—	Comma-separated list of GitLab project full paths. When set, scopes finding definition sync to only the specified projects.

Delta sync

Not supported. The connector performs a full sync of Secret Detection Finding Definition on every run and applies no incremental date filter.

API

• Type: GraphQL query (reuses Secret Detection Finding vulnerability data, de-duplicated by name) · Endpoint: POST /api/graphql
• Default filters: reportType: [SECRET_DETECTION]
• Query: Same as Secret Detection Finding, de-duplicated by name.

Open Source Finding

Operation options

Option	Type	Default	Description
severity	String	—	Filter by severity (INFO, UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL)
projectFullPath	String	—	Comma-separated list of GitLab project full paths (e.g., my-group/my-project, my-group/other-project). When set, finding sync is scoped to only the specified projects, bypassing full project enumeration.

Delta sync

Not supported. The connector performs a full sync of Open Source Finding on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST /api/graphql
• Default filters: reportType: [DEPENDENCY_SCANNING]

query($fullPath: ID!, $first: Int!, $after: String, $reportType: [VulnerabilityReportType!], $severity: [VulnerabilitySeverity!]) {
  project(fullPath: $fullPath) {
    page: vulnerabilities(first: $first, after: $after, reportType: $reportType, severity: $severity) {
      pageInfo { endCursor hasNextPage }
      nodes {
        id title state severity reportType
        scanner { externalId name vendor }
        identifiers { name url externalId externalType }
        project { id name fullPath }
        location {
          ... on VulnerabilityLocationSast {
            file startLine vulnerableClass vulnerableMethod
          }
          ... on VulnerabilityLocationDependencyScanning {
            file dependency { package { name } version }
          }
          ... on VulnerabilityLocationSecretDetection {
            file startLine
          }
        }
        description solution falsePositive
      }
    }
  }
}

Open Source Finding Definition

Operation options

Option	Type	Default	Description
severity	String	—	Filter by severity
projectFullPath	String	—	Comma-separated list of GitLab project full paths. When set, scopes finding definition sync to only the specified projects.

Delta sync

Not supported. The connector performs a full sync of Open Source Finding Definition on every run and applies no incremental date filter.

API

• Type: GraphQL query (reuses Open Source Finding vulnerability data, de-duplicated by name) · Endpoint: POST /api/graphql
• Default filters: reportType: [DEPENDENCY_SCANNING]
• Query: Same as Open Source Finding, de-duplicated by name.

Changelog

Changelog

The GitLab connector has undergone the following changes:

Version	Description	Migration Steps	Date Published
3.1.3	New Features - Added GitLab Security Attributes: the connector discovers security-attribute categories (such as Application Type or Leader) and adds one multi-valued SECURITY_ATTRIBUTE_<CATEGORY> column on Code Project, each value a JSON object pairing the attribute's id and name. Requires GitLab Ultimate. - Added a Security attribute group path setting to scope discovery to specific top-level group paths. - Code Project now includes TOP_LEVEL_GROUP_ID, TOP_LEVEL_GROUP_NAME, TOP_LEVEL_GROUP_FULL_PATH, and TOP_LEVEL_GROUP_WEB_URL. Bug Fixes - Project labels are no longer dropped from Code Project on incremental (cache-served) syncs.	N/A	June 24th, 2026
3.1.2	Improvements - Custom attributes on the Code Project and Package models now register with the correct cross-connector consolidation priority. Bug Fixes - Corrected the Package model's pipeline ID attributes ("Pipeline ID", "Pipeline project ID", "Pipeline user id") from numbers to text. ("Pipeline IID" is genuinely numeric and is unchanged.)	• Package: the "Pipeline ID", "Pipeline project ID", and "Pipeline user id" attributes changed from numbers to text. • Re-sync the GitLab connector to repopulate packages with the corrected type.	June 9th, 2026
3.1.1	New Features - Added support for Secret Detection findings as separate Secret Detection Finding and Secret Detection Finding Definition models. Improvements - Added a STATUS attribute to the Code Repository model, defaulting to "active".	N/A	May 27th, 2026
3.1.0	New Features - The connector now retrieves GitLab data through the GitLab GraphQL API with cursor-based pagination. - Added a Custom Headers configuration option for attaching custom HTTP headers to requests. Improvements - The Code Project attribute set was modernized to align with the GraphQL API. - The Parallel requests setting now controls parallelism per model sync.	• Code Project: the attribute set changed during the GraphQL migration (legacy attributes were dropped). • Re-sync the GitLab connector to repopulate Code Project records.	—
3.0.2	Added a Labels attribute to the Code Project model, capturing the labels defined on each GitLab project.	N/A	November 30th, 2024
3.0.1	Bug Fixes - Corrected the Person model's "Created by" attribute from a number to text.	• Person: the "Created by" attribute changed from a number to text. • Re-sync the GitLab connector.	August 15th, 2024
3.0.0	Initial Integration+ release.	N/A	July 17th, 2024