Security & Access

Developer friendly

Compliance work fits into the pipelines your team runs instead of living in a console tab — built on scoped API tokens, a documented GraphQL API, and controls you keep in version control.

A token for one job can't touch the rest

An automation that writes evidence never gets the keys to your whole account. Both organization tokens and personal access tokens are scoped by object and action, so each one can do exactly its job and nothing more.

Scoped to read, write, or delete on the objects you choose
Revoke a single token without breaking the integrations next to it

PERMISSIONS FLOW DOWNPlatform groupGRANTEDEvery member of itINHERITEDObjects attached to itINHERITEDAPI TOKENS FOLLOW THE SAME MODELAn integration tokenORG SCOPEDSCOPED TOA SPECIFIC OBJECT TYPEOPERATIONSREAD / WRITE / DELETE

Sync evidence from the job that produced it

Audit prep stops being a screenshot hunt when the job that produces the proof also files it. Post evidence to the GraphQL API straight from the pipeline that generated it, whether that's a nightly access review export, a scan result, or a signed artifact, so there's nothing to capture by hand and nothing to chase before an audit.

Post evidence over GraphQL, attached to the control it supports
Run it on a schedule, from CI, or on demand

Sync evidence from the job that produced it

Controls as code, reviewed like code

Your control set gets the same review, history, and rollback as the rest of your engineering work — a change arrives through code review instead of a console click nobody logged.

Controls and subcontrols defined in version control
Push with the Openlane client, from CI or by hand

controls/access-control.yaml

refCode:AC-2

description:Account Management

referenceFramework:NIST 800-53

referenceFrameworkRevision:rev5

status:PREPARING

subcontrols:

- refCode:AC-2.1

description:Provisioning approvals

status:PREPARING

$ courier push controls/

✓ parsed 14 files

✓12 created · 2 updated

Controls14 SYNCED

AC-2Account Management

NIST 800-53CC6.1

AC-2.1Provisioning approvals

CM-3Change control

+ 11 more from this push

git → courier → openlane · version controlled, reviewable, repeatable

Build the integration we haven't built yet

You're never blocked waiting for us to ship a connector. Every object in Openlane, from controls to evidence, is reachable over the same GraphQL API the console uses, so if your internal HR system or self-hosted scanner isn't on the integrations list, the API is the integration list.

The same API the console runs on, with webhooks and a CLI
Open source, so you can read exactly what it does

Build the integration we haven't built yet

I wanted to build a feed of security training data from our platform into Openlane, and their APIs were easy to work with: clear documentation, straightforward authentication, and helpful examples. I was able to stand up my desired functionality very quickly, and now if a user stores an Openlane API key with us, we can reliably sync their security training data into the platform for use as evidence.

Chad Kearney, Stronta

Built for the Terminal

An API you'd want to build on

Compliance tools tend to treat the API as an escape hatch. Openlane exposes the same GraphQL API the console runs on, with scoped tokens and webhooks, so automating the boring parts is the normal path rather than a workaround.

No API upsell

The API isn't a higher tier or an add-on line item. Every plan gets the same endpoints, the same tokens, and the same webhooks.

Documented, not reverse-engineered

A published GraphQL schema and docs that describe what the console does, so you're building against a contract instead of a network tab.

Evidence from the jobs you run

Push evidence from the CI jobs you already run, and audit prep stops being a quarter-end scramble for screenshots.

Trusted By