Snyk integration

Connecting Snyk lets DXDT surface your vulnerable projects and their open issues by severity across your Snyk organizations to feed the security pillar. The integration is strictly read-only.

Setup time	~5 minutes
Difficulty	Easy

Access required: A Snyk user (or service account) that can read the target organizations and projects

Prerequisites

• A Snyk account with access to the organizations you want DXDT to see
• The orgId of at least one organization you want monitored (found under Settings > General for the org)

Setup

1. Open your Snyk account settings

Sign in to Snyk and open Account settings from the user menu in the top-right, or go directly to https://app.snyk.io/account.

Note

Prefer a dedicated service account or a low-privilege user so the token inherits only the read access DXDT needs.

2. Locate or generate your API token

In the General section of Account settings, find the Auth Token (also labelled API token). Click Click to show to reveal the existing token, or use Regenerate if you need a fresh one.

• Copy the token value; it is a UUID-style string.
• The token inherits the permissions of the account it belongs to, so keep that account limited to read access on the relevant orgs.

Note

Snyk personal tokens are not individually scopeable, so grant the underlying account no more than read/viewer access to the organizations and projects you want DXDT to reach.

3. Confirm the organizations you want monitored

For each org, open its settings and copy the orgId shown under Settings > General. DXDT uses list orgs to discover organizations the token can see and then reads projects and issues per org.

Note

DXDT only reads: organizations, projects with issue counts, and aggregated open issues by severity.

Configuration fields

Field	Where to find it
Snyk API Token (api_token)	The Auth Token / API token from Account settings > General (https://app.snyk.io/account). Sent as Authorization: token <TOKEN>.

Verify the connection

Paste the token into the Snyk plugin's Configuration tab and click Install & Configure; the Live Status panel should turn healthy and show the authenticated user and the organizations the token can see.

Security

Your Snyk API token is stored encrypted per-tenant and is used only for read-only Snyk API operations.

Troubleshooting

Unauthorized (401) — invalid Snyk API token

The token is mistyped, has been regenerated, or was revoked. Re-copy the current Auth Token from Account settings and re-save the configuration.

Forbidden (403) — token lacks access to this org/project

The account behind the token is not a member of the organization or project you are querying. Add the account as a read-only member of the relevant org, or use an orgId the account can actually see.

No organizations returned by list orgs

The token belongs to an account with no org memberships. Invite the account to at least one organization with viewer access and retry.

---

Vendor documentation: https://docs.snyk.io/snyk-api/authentication-for-api