Obsidian Security

Identity Risk Management

Overview
Setup
Data & mappings
Operations & API
Changelog

The Obsidian Security Connector integrates with the Obsidian Security platform to fetch and synchronize security posture data, including tenants, user accounts, entities, compliance standards, rules, violations, and settings. It maps these external objects into the internal Unified Data Model (UDM) to enable comprehensive security analysis, reporting, and remediation tracking.

Data retrieved from Obsidian Security

Connector Object	Required	Maps to Data Model
Tenant	Yes	Cloud Resource
Account	Yes	Cloud Resource
User	Yes	Person
Entity	Yes	Entity
Compliance Standard	Yes	Compliance Standard
Compliance Control	Yes	Compliance Control
Rule	Yes	Violation Definition
Rule Violation	Yes	Violation
Setting	Yes	Violation Definition
Setting Violation	Yes	Violation

Model relationships

note

For detailed steps on how to view the data retrieved from Obsidian Security in the Brinqa Platform, see How to view your data.

Connection settings

When setting up a data integration, select Obsidian Security from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	`https://<obsidian-server>/`	Obsidian Security server URL
API token	Yes	—	Obsidian Security API token
Page size	No	`100`	Maximum number of records to get per API request
Maximum retries	No	`5`	The maximum number of retry attempts before giving up a request
Parallel requests	No	`min(4, CPU cores)`	Maximum number of parallel API requests

Authentication

The connector authenticates with the Obsidian Security API using Bearer Token authentication. The API token is supplied during configuration and is sent on every request as an Authorization: Bearer <apiToken> header. There is no separate token-exchange step — the configured token is used directly.

Connection Verification Endpoint

On connection setup the connector verifies credentials by listing tenants:

Method	URL
`GET`	`https://<obsidian-server>/v1/connection-management/tenants`

Request Headers

Header	Value
`Authorization`	`Bearer <apiToken>`
`Content-Type`	`application/json`

Request Body

GraphQL queries (v1/gql) and Posture list endpoints are issued as POST requests whose body is a JSON payload (for GraphQL: { "query": "...", "variables": { ... } }; for Posture list endpoints: a paging payload with limit, optional cursor, optional tenant_id/tenant_uuid, and a filter object). The connection-verification call above is a GET and carries no body.

Sample Response

Example response from the connection-verification (tenants) endpoint:

{
  "data": [
    {
      "id": "tenant-123",
      "name": "Acme Production",
      "platform": "OKTA",
      "platformId": "okta-abc",
      "production": true,
      "sensitivity": "HIGH",
      "obsidianProducts": [
        "EXTEND",
        "MONITOR"
      ],
      "updatedBy": "system",
      "updatedTime": "2026-05-01T12:00:00Z"
    }
  ],
  "cursor": null,
  "hasMoreResults": false
}

Response Fields

Field	Type	Description
`data`	array	Array of resource objects returned for the request
`cursor`	string	Opaque pagination token for the next page (null if last)
`hasMoreResults`	boolean	Indicates whether additional pages are available

Usage

A successful response confirms the token is valid. Once configured, all subsequent API requests include the bearer token:

Authorization: Bearer <apiToken>

Sync Behavior

Each sync is a full sync. The connector does not apply an incremental since filter to any model, so every run re-fetches the complete set of records for each enabled object. A sync token may be accepted but is not used to filter results server-side; the per-object behavior is documented under each object's Sync Duration Parameter.

How to obtain Obsidian Security credentials

Obtain the required credentials (url, apiToken) from your Obsidian Security administrator or the Obsidian Security admin console, then enter them in the connection settings above.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Tenant

Source Field Name	SDM Attribute
sync time	LAST_CAPTURED
`TenantMetaData.meta`	META
`TenantResource.id`	UID
`TenantResource.id`	TENANT_ID
`TenantResource.idpCapable`	IDP_CAPABLE
`TenantResource.isCustom`	IS_CUSTOM
`TenantResource.isIdp`	IS_IDP
`TenantResource.isMarketplace`	IS_MARKETPLACE
`TenantResource.isOnPrem`	IS_ON_PREM
`TenantResource.logoDescriptor`	LOGO_DESCRIPTOR
`TenantResource.name`	NAME
`TenantResource.obsidianProducts`	OBSIDIAN_PRODUCTS
`TenantResource.platform`	PLATFORM
`TenantResource.platformId`	PLATFORM_ID
`TenantResource.production`	PRODUCTION
`TenantResource.sensitivity`	SENSITIVITY
`TenantResource.tags`	TAGS
`TenantResource.updatedBy`	UPDATED_BY
`TenantResource.updatedTime`	UPDATED_TIME
`TenantResource.updatedTime`	SOURCE_LAST_MODIFIED
`TenantResource.value`	VALUE

Account

Source Field Name	SDM Attribute
`AccountResource.addresses[] (formatted)`	ADDRESSES
`AccountResource.aliases`	ALIASES
`AccountResource.alternativeEmails[].raw`	ALTERNATIVE_EMAILS
`AccountResource.alternativeNames`	ALTERNATIVE_NAMES
`AccountResource.alternativePhones[].raw`	ALTERNATIVE_PHONES
`AccountResource.automated`	IS_AUTOMATED
`AccountResource.email.raw`	EMAILS
`AccountResource.enabled`	ENABLED
`AccountResource.entitySubType`	ENTITY_SUB_TYPE
`AccountResource.firstName`	FIRST_NAME
`AccountResource.id`	ACCOUNT_ID
`AccountResource.isAdmin`	IS_ADMIN
`AccountResource.isDeleted`	IS_DELETED
`AccountResource.isLicensed`	IS_LICENSED
`AccountResource.isRestricted`	IS_RESTRICTED
`AccountResource.lastName`	LAST_NAME
`AccountResource.mfaEnabled`	IS_MFA_ENABLED
`AccountResource.name`	NAME
`AccountResource.name + tenantId (or nativeId + tenantId)`	UID
`AccountResource.nativeId`	NATIVE_ID
`AccountResource.obsidianStatus`	OBSIDIAN_STATUS
`AccountResource.phone.raw`	PHONE_NUMBERS
`AccountResource.phone.type`	PHONE_TYPE
`AccountResource.roles[].name`	ROLES
`AccountResource.services[].name`	SERVICES
`AccountResource.status`	PROVIDER_STATUS
`AccountResource.status (normalized)`	SOURCE_STATUS
`AccountResource.temporalProperties.created`	CREATED_TIME
`AccountResource.temporalProperties.created`	SOURCE_CREATED_DATE
`AccountResource.temporalProperties.deleted`	DELETED_TIME
`AccountResource.temporalProperties.firstActive`	FIRST_ACTIVE
`AccountResource.temporalProperties.firstObserved`	FIRST_OBSERVED
`AccountResource.temporalProperties.lastActive`	LAST_ACTIVE
`AccountResource.temporalProperties.lastModified`	LAST_MODIFIED
`AccountResource.temporalProperties.lastModified`	SOURCE_LAST_MODIFIED
`AccountResource.temporalProperties.lastObserved`	LAST_OBSERVED
`AccountResource.temporalProperties.terminated`	TERMINATION_DATE
`AccountResource.tenantId`	TENANT_ID
`AccountResource.user.id`	USER_ID
`AccountResource.userGroups`	USER_GROUPS
`AccountResource.username`	USERNAME
sync time	LAST_CAPTURED

User

Source Field Name	SDM Attribute
sync time	LAST_CAPTURED
`UserResource.accounts[].name`	ACCOUNTS
`UserResource.department`	DEPARTMENT
`UserResource.division`	DIVISION
`UserResource.email.raw`	EMAILS
`UserResource.email.raw (or id)`	UID
`UserResource.enabled`	ENABLED
`UserResource.entitySubType`	ENTITY_SUB_TYPE
`UserResource.firstName`	FIRST_NAME
`UserResource.id`	USER_ID
`UserResource.isDeleted`	IS_DELETED
`UserResource.isPrivileged`	IS_PRIVILEGED
`UserResource.isServiceAccount`	IS_SERVICE_ACCOUNT
`UserResource.isTerminated`	IS_TERMINATED
`UserResource.jobTitle`	JOB_TITLE
`UserResource.lastName`	LAST_NAME
`UserResource.name`	NAME
`UserResource.nativeId`	NATIVE_ID
`UserResource.phone.raw`	PHONE_NUMBERS
`UserResource.rawRefs`	RAW_REFS
`UserResource.services[].name`	SERVICES
`UserResource.temporalProperties.created`	CREATED_TIME
`UserResource.temporalProperties.created`	SOURCE_CREATED_DATE
`UserResource.temporalProperties.lastModified`	LAST_MODIFIED
`UserResource.temporalProperties.lastModified`	SOURCE_LAST_MODIFIED
`UserResource.tenantId`	TENANT_ID
`UserResource.timezone`	TIMEZONES
`UserResource.userGroups`	USER_GROUPS

Entity

Source Field Name	SDM Attribute
`EntityResource.entitySubType`	ENTITY_SUB_TYPE
`EntityResource.id`	ENTITY_ID
`EntityResource.isDeleted`	IS_DELETED
`EntityResource.name`	NAME
`EntityResource.nativeId`	NATIVE_ID
`EntityResource.rawRefs`	RAW_REFS
`EntityResource.services[].name`	SERVICES
`EntityResource.temporalProperties.created`	CREATED_TIME
`EntityResource.temporalProperties.created`	SOURCE_CREATED_DATE
`EntityResource.temporalProperties.lastModified`	LAST_MODIFIED
`EntityResource.temporalProperties.lastModified`	SOURCE_LAST_MODIFIED
`EntityResource.tenantId`	TENANT_ID
`EntityResource.userGroups`	USER_GROUPS
nativeId or name + tenantId	UID
sync time	LAST_CAPTURED

note

Pagination Limitation: The API is returning a null cursor(next page) before all records/pages have been retrieved, causing pagination to stop early. As a result, the connector may only fetch a partial set of records. This issue has been reported and the obsidian team is looking into it.

Compliance Standard

Source Field Name	SDM Attribute
`ComplianceStandardResource.description`	DESCRIPTION
`ComplianceStandardResource.id`	UID
`ComplianceStandardResource.id`	STANDARD_ID
`ComplianceStandardResource.isCustom`	IS_CUSTOM
`ComplianceStandardResource.isNormalized`	IS_NORMALIZED
`ComplianceStandardResource.link`	LINK
`ComplianceStandardResource.name`	NAME
`ComplianceStandardResource.orgId`	ORG_ID
`ComplianceStandardResource.publisher`	PUBLISHER
`ComplianceStandardResource.version`	VERSION
sync time	LAST_CAPTURED

Compliance Control

Source Field Name	SDM Attribute
`ComplianceControlResource.description`	DESCRIPTION
`ComplianceControlResource.id`	UID
`ComplianceControlResource.id`	CONTROL_ID
`ComplianceControlResource.identifier`	IDENTIFIER
`ComplianceControlResource.link`	LINK
`ComplianceControlResource.name`	NAME
`ComplianceControlResource.standardId`	STANDARD_ID
sync time	LAST_CAPTURED

Rule

Source Field Name	SDM Attribute
`RuleResource.analyticId`	ANALYTIC_ID
`RuleResource.benchmark`	BENCHMARK
`RuleResource.controlIds`	CONTROL_IDS
`RuleResource.createdAt`	CREATED
`RuleResource.createdAt`	SOURCE_CREATED_DATE
`RuleResource.description`	DESCRIPTION
`RuleResource.descriptionShort`	DESCRIPTION_SHORT
`RuleResource.id`	UID
`RuleResource.id`	RULE_ID
`RuleResource.name`	NAME
`RuleResource.obsidianRule`	OBSIDIAN_RULE
`RuleResource.remediationInstructions`	RECOMMENDATION
`RuleResource.remediationInstructions`	REMEDIATION_INSTRUCTIONS
`RuleResource.riskLevel`	RISK_LEVEL
`RuleResource.riskLevel`	SOURCE_SEVERITY
`RuleResource.riskLevel (normalized)`	SEVERITY
`RuleResource.riskLevel (scored)`	SEVERITY_SCORE
`RuleResource.standardIds`	STANDARD_IDS
`RuleResource.type`	RULE_TYPE
`RuleResource.updatedAt`	LAST_UPDATED
`RuleResource.updatedAt`	SOURCE_LAST_MODIFIED
`RuleResource.violations`	VIOLATIONS
sync time	LAST_CAPTURED

Rule Violation

Source Field Name	SDM Attribute
Normalized state/riskAccepted	SOURCE_STATUS
`RuleResource.exceptionsCount.active`	EXCEPTIONS_COUNT_ACTIVE
`RuleResource.exceptionsCount.inactive`	EXCEPTIONS_COUNT_INACTIVE
`RuleResource.id`	TYPE
`RuleResource.platformId`	PLATFORM_ID
`RuleResource.productIds`	PRODUCT_IDS
`RuleResource.releaseLabel`	RELEASE_LABEL
`RuleResource.riskAccepted`	RISK_ACCEPTED
`RuleResource.securityDomain`	SECURITY_DOMAIN
`RuleResource.state`	STATE
`RuleResource.state`	PROVIDER_STATUS
`RuleResource.tags`	TAGS
`RuleResource.tenantUuid`	TENANT_UUID
`RuleResource.tenantUuid`	TARGETS
`RuleResource.type`	CATEGORIES
`RuleViolationResource (raw JSON)`	RESULTS
`RuleViolationResource.accountId`	TARGETS
`RuleViolationResource.appName + tenantId`	TARGETS
`RuleViolationResource.clientId`	TARGETS
`RuleViolationResource.id + tenantId (Resource ID)`	TARGETS
`RuleViolationResource.name + tenantId`	TARGETS
`RuleViolationResource.obsecFirstSeen`	FIRST_SEEN
`RuleViolationResource.obsecFirstSeen`	OBSEC_FIRST_SEEN
`RuleViolationResource.obsecLastRemediated`	LAST_REMEDIATED
`RuleViolationResource.obsecLastRemediated`	OBSEC_LAST_REMEDIATED
`RuleViolationResource.obsecLastSeen`	LAST_SEEN
`RuleViolationResource.obsecLastSeen`	OBSEC_LAST_SEEN
`RuleViolationResource.orgName + tenantId`	TARGETS
`RuleViolationResource.policyName + tenantId`	TARGETS
`RuleViolationResource.repositoryName + tenantId`	TARGETS
`RuleViolationResource.tenantId`	TENANT_ID
`RuleViolationResource.tokenId`	TARGETS
`RuleViolationResource.userName + tenantId`	TARGETS
`RuleViolationResource.violationId`	UID
`RuleViolationResource.violationId`	NAME
sync time	LAST_CAPTURED

note

The Violation resource contains many context-specific attributes depending on the product being monitored (e.g., GitHub, Okta, Workday). These are captured in the RESULTS attribute as raw JSON.

Setting

Source Field Name	SDM Attribute
`SettingResource.controlIds`	CONTROL_IDS
`SettingResource.description`	DESCRIPTION
`SettingResource.description`	RECOMMENDATION
`SettingResource.id`	UID
`SettingResource.name`	NAME
`SettingResource.riskLevel`	RISK_LEVEL
`SettingResource.riskLevel`	SOURCE_SEVERITY
`SettingResource.riskLevel (normalized)`	SEVERITY
`SettingResource.riskLevel (scored)`	SEVERITY_SCORE
`SettingResource.standardIds`	STANDARD_IDS
sync time	LAST_CAPTURED

Setting Violation

Source Field Name	SDM Attribute
`Instant.now()`	LAST_CAPTURED
`normalizeFindingStatus(status)`	SOURCE_STATUS
`SettingResource.canSetValue`	CAN_SET_VALUE
`SettingResource.dataType`	DATA_TYPE
`SettingResource.id`	TYPE
`SettingResource.isActivityBased`	IS_ACTIVITY_BASED
`SettingResource.lastScanned`	LAST_SCANNED
`SettingResource.lastStateChange`	LAST_SEEN
`SettingResource.lastStateChange`	LAST_STATE_CHANGE
`SettingResource.location`	LOCATION
`SettingResource.operation`	OPERATION
`SettingResource.options`	OPTIONS
`SettingResource.orgId`	ORG_ID
`SettingResource.platformCategory`	PLATFORM_CATEGORY
`SettingResource.platformCategory`	CATEGORIES
`SettingResource.platformId`	PLATFORM_ID
`SettingResource.platformSettingId`	PLATFORM_SETTING_ID
`SettingResource.productIds`	PRODUCT_IDS
`SettingResource.releaseLabel`	RELEASE_LABEL
`SettingResource.riskAccepted`	RISK_ACCEPTED
`SettingResource.securityDomain`	SECURITY_DOMAIN
`SettingResource.state`	STATE
`SettingResource.state`	PROVIDER_STATUS
`SettingResource.tags`	TAGS
`SettingResource.target`	SETTING_TARGET
`SettingResource.tenantId`	TENANT_ID
`SettingResource.tenantUuid`	TENANT_UUID
`SettingResource.tenantUuid`	TARGETS
`SettingResource.uniqueId`	UID
`SettingResource.uniqueId`	NAME
`SettingResource.uniqueId`	UNIQUE_ID
`SettingResource.units`	UNITS
`SettingResource.value`	VALUE

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Tenant

Operation options

Option	Type	Default	Description
`include_custom_fields`	Boolean	`false`	When `true`, fetches each tenant's custom metadata fields and populates the multi-valued `META` attribute.

Delta sync

Not supported. The connector performs a full sync of Tenant on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET v1/connection-management/tenants

note

Custom fields (optional). When the include_custom_fields operation option is enabled, the connector additionally retrieves each tenant's custom metadata fields from GET v1/connection-management/tenant?tenant_id=<id> and records them in a single multi-valued META attribute on the Tenant model. Each entry is formatted as key:value, one per custom field. Because these fields are discovered dynamically, the exact set of values depends on the metadata configured in your Obsidian Security tenants. This behavior is disabled by default.

Account

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Account on every run and applies no incremental date filter.

API

Type: GraphQL · Endpoint: POST v1/gql

query getAccounts($filter: AccountFilter, $limit: Limit, $orderBy: [AccountOrderBy!]!, $query: String, $token: ID) {
    getAccounts(filter: $filter, limit: $limit, orderBy: $orderBy, query: $query, token: $token) {
        results {
            id
            name
            nativeId
            username
            firstName
            status
            tenantId
            email { raw }
            enabled
            entitySubType
            userGroups
            aliases
            automated
            isAdmin
            isDeleted
            isLicensed
            isRestricted
            lastName
            mfaEnabled
            obsidianStatus
            rawRefs
            lastSeenLocation {
                location {
                    city
                    country
                    postalCode
                    subdivision
                    geoLocation { latitude longitude }
                    geoLocationSource
                }
            }
            temporalProperties {
                created
                deleted
                firstActive
                firstObserved
                lastActive
                lastModified
                lastObserved
                terminated
            }
            addresses { city country postalCode region street }
            alternativeNames
            alternativeEmails { raw }
            alternativePhones { raw type }
            phone { raw type }
            roles { name }
            user(idOnly: true) { id }
            services { serviceId name }
        }
        cursor
        hasMoreResults
    }
}

User

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of User on every run and applies no incremental date filter.

API

Type: GraphQL · Endpoint: POST v1/gql

query getUsers($filter: UserFilter, $limit: Limit, $orderBy: [UserOrderBy!]!, $query: String, $token: ID) {
    getUsers(filter: $filter, limit: $limit, orderBy: $orderBy, query: $query, token: $token) {
        results {
            email { raw }
            phone { raw }
            department
            division
            isDeleted
            isPrivileged
            isServiceAccount
            isTerminated
            id
            name
            firstName
            lastName
            jobTitle
            tenantId
            enabled
            entitySubType
            nativeId
            rawRefs
            timezone
            userGroups
            accounts { id name nativeId }
            services { name }
            temporalProperties {
                lastModified
                created
                firstActive
                firstObserved
                lastActive
                lastObserved
                terminated
            }
        }
        cursor
        hasMoreResults
    }
}

Entity

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Entity on every run and applies no incremental date filter.

API

Type: GraphQL · Endpoint: POST v1/gql
Default filters: baseType NIN [ACCOUNT] (excludes account entities)

query getEntitiesTable($filter: EntityFilter, $limit: Limit, $bulk: Boolean, $query: String, $token: ID) {
    getEntities(filter: $filter, limit: $limit, bulk: $bulk, query: $query, token: $token) {
        results {
            id
            name
            nativeId
            isDeleted
            rawRefs
            entitySubType
            services { serviceId name }
            temporalProperties {
                lastModified
                created
                firstActive
                firstObserved
                lastActive
                lastObserved
                terminated
            }
            tenantId
            userGroups
        }
        cursor
        hasMoreResults
    }
}

Compliance Standard

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Compliance Standard on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET posture/v3_0/compliance/list

Compliance Control

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Compliance Control on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: GET posture/v3_0/compliance/info/{standardId}

Rule

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Rule on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: POST posture/v3_0/rules/list

Rule Violation

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Rule Violation on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: POST posture/v3_0/rules/info/{ruleId}/preview
Default filters: Scoped per rule by the rule's tenant_id in the request payload

Setting

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Setting on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: POST posture/v3_0/settings/list

Setting Violation

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Setting Violation on every run and applies no incremental date filter.

API

Type: REST endpoint · Endpoint: POST posture/v3_0/settings/list

Changelog

The Obsidian Security connector has undergone the following changes:

Version	Description	Migration Steps
3.0.2	New Features - Custom fields on Tenant (optional) — Added an optional "include_custom_fields" sync option for the Tenant object (disabled by default). When enabled, the connector retrieves each tenant's custom metadata fields from Obsidian Security and maps them onto the Tenant model as a new multi-valued Meta attribute, with each entry recorded as a `key:value` pair. Improvements - Multi-valued attribute matching — Multi-valued attributes across all objects (such as user groups, aliases, roles, services, addresses, product IDs, and compliance standard/control IDs) now declare collection matching criteria, so their individual values are correlated and consolidated more accurately within Brinqa.	N/A
3.0.1	Bug Fixes - Rule Violation target resolution — Fixed target resolution for OAuth token violations to include tenant context, ensuring violations are correctly associated with their tenant - Rule Violation multi-value fields — Fixed handling of API fields (`ID`, `User email`, `App name`) that may return either a single value or an array, preventing deserialization errors during sync Improvements - Documentation — Enhanced README with endpoint details, usage examples, pagination limitation notes for Entity, and updated configuration table with required/optional indicators Known Issues - Entity pagination limitation — The Obsidian Security API may return a null cursor before all records/pages have been retrieved, causing pagination to stop early. As a result, the connector may only fetch a partial set of Entity records. This issue has been reported and the obsidian team is looking into it.	N/A
3.0.0	New Features - Initial release of the Obsidian Security connector with support for 10 data object types: - Account — SaaS user accounts with identity details, roles, services, MFA status, and temporal activity data - Compliance Standard — Compliance frameworks and standards tracked by Obsidian Security - Compliance Control — Individual compliance controls within standards, with pass/fail status - Entity — Non-account entities (applications, groups, resources) observed across SaaS services - Rule — Posture rules that define security policies, with severity, risk acceptance, and exception counts - Rule Violation — Individual violations of posture rules, with violation targets and remediation tracking - Setting — Security setting definitions for SaaS configuration posture - Setting Violation — Individual violations of security settings, with affected services and tenants - Tenant — SaaS tenant configurations with connection status and service details - User — Consolidated user identities across SaaS services, with account associations and activity data - Authentication — Bearer Token authentication via API key - Data Retrieval — GraphQL-based retrieval for Account, Entity, and User; REST API-based retrieval for all other object types - Sync Mode — Full sync only; all object types perform a complete data fetch on every sync (no delta/incremental sync) - Configuration — Configurable page size, retry logic, and parallelism level for data synchronization - Parallel Processing — Concurrent violation fetching across multiple rules for improved sync performance Known Issues - Entity pagination limitation — The Obsidian Security API may return a null cursor before all records/pages have been retrieved, causing pagination to stop early. As a result, the connector may only fetch a partial set of Entity records. This issue has been reported and the obsidian team is looking into it.	N/A

Data retrieved from Obsidian Security​

Model relationships​

Connection settings​

Authentication​

Connection Verification Endpoint​

Request Headers​

Request Body​

Sample Response​

Response Fields​

Usage​

Sync Behavior​

Attribute mappings​

Operations & API​

Changelog​

Data retrieved from Obsidian Security

Model relationships

Connection settings

Authentication

Connection Verification Endpoint

Request Headers

Request Body

Sample Response

Response Fields

Usage

Sync Behavior

Attribute mappings

Operations & API

Changelog