Integrations
Bring lifecycle metadata from your vaults, cloud providers, and automation into a shared ownership and deadline register. Secret values remain in your systems.
Supported integrations · Integration roadmap · Requests and partnerships
Available
These connections are included in every workspace plan, subject to inventory capacity. Provider permissions, licensing, and usage charges apply. Coverage reviewed October 30, 2026.
EventBridge delivery
Resource and version changes, rotation requests, and explicit RotationSucceeded events. Active-version changes remain a separate evidence class.
Requirements: An EventBridge API Destination and a scoped KeyGuardRail credential. CloudTrail-derived events require a trail. Secret-value access is not required.
Authenticated Event Grid delivery
Version, near-expiry, and expiration events for secrets, keys, and certificates. A new version does not establish successful rotation.
Requirements: Public Azure, an Event Grid subscription, and Microsoft Entra authentication. Sovereign clouds and CloudEvents delivery are outside the supported scope.
Authenticated Pub/Sub delivery
Secret and version changes, availability observations, and scheduled rotation requests. A rotation request does not establish completion.
Requirements: A Secret Manager notification topic and authenticated Pub/Sub push subscription. KeyGuardRail verifies the service account, audience, project, and subscription.
Customer-hosted KV v2 collector
Version and availability metadata from explicitly configured KV v2 paths. The collector does not read secret values or manage dynamic-secret leases.
Requirements: Read permission on selected metadata paths. Verified with Vault Community; Enterprise namespaces require deployment-specific validation. WebSocket events are outside this collector’s scope.
Customer-hosted Events API collector
Item-creation and change observations for a configured vault. Item changes do not establish target-system rotation or deletion.
Requirements: Business Events Reporting with Item Usage access. US, EU, and Canada endpoints are supported; dedicated Enterprise endpoints are outside this scope.
Customer-hosted Public Events API collector
Secret creation, edit, and deletion observations for cloud organizations in the US or EU. Self-hosted endpoints are outside this scope.
Requirements: Public API access through an eligible Password Manager Teams or Enterprise organization. Its API key has broad organization-management authority and stays on your host; a Secrets Manager subscription alone does not establish eligibility.
Customer automation over HTTPS
Read, create, and update mapped inventory; report lifecycle events and explicit automation outcomes; inspect delivery and processing status.
Requirements: Integration-specific credentials with explicit scopes and expiration. Requests carry lifecycle metadata only and follow workspace capacity limits.
Data and control
Administrators map provider resources to inventory records and choose which fields a connection may update. Mappings require review by default. Newer manual changes and events are protected from being overwritten by older observations.
KeyGuardRail distinguishes requests, version changes, availability observations, and reported rotation completion. The three customer-hosted collectors record observations only; they do not update rotation dates or expiration. Their source access credentials stay on your host.
Review the security architectureReview operations, scopes, event schemas, and response codes for your own automation.
Open the OpenAPI specificationConfigure provider permissions, protected credential files, scheduling, checkpoints, and recovery.
Read the collector guideWorkspace owners and administrators can configure integrations and access provider-specific setup instructions after signing in.
Integration roadmap
These providers are candidates for additional native coverage. Under evaluation means the integration approach has been researched and awaits implementation prioritization. These connectors are not available, and no release dates are committed.
| Provider | Proposed scope | Status |
|---|---|---|
| Doppler | Configuration change notifications | Under evaluation |
| Infisical | Secret change and rotation-failure notifications | Under evaluation |
| Akeyless | Lifecycle and rotation-outcome forwarding | Under evaluation |
| CyberArk PAM / Privilege Cloud | Account metadata and rotation-outcome reporting | Under evaluation |
| Delinea Secret Server | Lifecycle events and remote password-change outcomes | Under evaluation |
| Keeper Secrets Manager / KeeperPAM | Audit metadata and PAM rotation-outcome reporting | Under evaluation |
Your existing automation can use the generic API where it can report the required metadata and outcomes. This requires customer implementation and does not imply a native connector for every provider.
Requests and partnerships
Tell us which provider and edition you use, whether it is cloud or self-hosted, and which lifecycle events or workflows matter to your team. Requests help inform integration priorities.
Request an integrationWe welcome discussions with vault, secrets-management, and credential-platform providers. Share your public API or event documentation, proposed use case, and technical contact to discuss compatibility and integration validation.
Contact partnershipsBoth enquiries go to hello@keyguardrail.com. Send product and workflow details without credentials or sensitive event payloads.