API keys for external systems
A team's scanner engines, issue trackers, alerts and enrichment services, and where AI and repository access are set.
Some scanners, the issue trackers, alerts and enrichment services work only once you give ScanSuite the address and credentials of the service behind them. They are set for a team on the Teams page, which opens from the user menu. The values apply to the current team only; other teams never see them.
Team admins and operators change these settings; other members see them read-only. Saved passwords and keys are stored encrypted and never shown again: a saved secret field reads Saved. Leave empty to keep it. Each block has its own Save button.
What is set where
| Where | What is there |
|---|---|
| Teams → Scanning | Scanner engines (OpenVAS, Acunetix), described below. Also the Team SSH key and the Server account, see Teams and roles. |
| Teams → Integrations | Issue trackers (DefectDojo, Securitm), Alerts (email, Telegram), Enrichment services (Snyk, Shodan, Dehashed), described below. |
| Teams → AI | The team's AI connections, models and per-task routing, see AI providers and cost. Only team admins change them. |
| System Settings → Shared services | What every team shares, set by a system administrator: the Nessus scanner, the Git service and the system AI. |
| My account → Repository access | Each person's own SSH key for cloning and Git repository API key. |
See Teams and roles, AI providers and cost and System Settings.
AI
AI connections, models and per-task routing are on the team's AI tab, see AI providers and cost. Only the system AI, set up in System Settings, can use a custom CA bundle or the deployment's own cloud identity instead of a key.
Repository access
Access to private repositories is set in three places:
| Setting | Where | What it is for |
|---|---|---|
| Team SSH key | Teams → Scanning → Team SSH key | The private key schedules, pipeline scans and members without a key of their own clone with. |
| Git service | System Settings → Shared services → Git service | GitLab, Bitbucket or GitHub for the whole installation; for Bitbucket also its address and SSH clone address pattern. |
| Personal SSH key and Git repository API key | My account → Repository access | A person's own key for the scans they start, and the key that lists repositories of a Bitbucket project. |
How they work together is described in Git repository authentication.
Scanner engines
The Scanner engines card on the Scanning tab connects the external scanners the team drives. Each block shows Connected once its address is saved, Not set before. The Nessus scanner is shared by all teams and set up by a system administrator.
OpenVAS (infrastructure scanning)
| Field | What to enter |
|---|---|
| Address | The OpenVAS server, for example https://openvas.example.com. |
| User name | An OpenVAS account that may create and run scans. |
| Password | That account's password. |
OpenVAS can run on the same server as ScanSuite or on a separate one. Installation is described in the official OpenVAS guide.
Acunetix (web application scanning)
| Field | What to enter |
|---|---|
| Address | The Acunetix server, for example https://acunetix.example.com:3443. |
| User name | The email address of an Acunetix account that may create and run scans. |
| Password (hashed) | Not the password itself: its SHA-256 hash in hexadecimal, the form Acunetix's sign-in expects. |
To compute the hash without leaving the password in the shell history, type it at the prompt of this command; it prints the 64-character value to paste:
read -rsp 'Acunetix password: ' p; echo; printf '%s' "$p" | sha256sum | cut -d' ' -f1; unset p
Issue trackers
The Issue trackers card on the Integrations tab sets where the team's findings are exported. Leave a tracker empty to keep findings in ScanSuite only.
| Block | Fields |
|---|---|
| DefectDojo | Address (for example https://dojo.example.com:8443) and API key. See Set up DefectDojo. |
| Securitm | Address and API key, to export findings to Securitm. See Export to Securitm. |
See Set up DefectDojo and Export to Securitm.
Alerts
The Alerts card on the same tab says where the team hears that a scan found a new asset or changed an asset's risk.
| Block | Field | What to enter |
|---|---|---|
| Mail server | Host, with an optional port: smtp.example.com:587. Without a port, 587 is used. | |
| Send to | Recipient addresses separated by commas. | |
| Send from | The sender address. | |
| Sender password | The sender account's password on the mail server. | |
| Telegram | Chat ID | The chat the alerts go to. |
| Telegram | Bot token | From @BotFather. Add the bot to the chat first. |
Enrichment services
The Enrichment services card on the same tab holds API keys for services that add context to findings and assets. Empty fields keep the saved key.
| Field | What it adds | Where the key comes from |
|---|---|---|
| Snyk | Dependency vulnerability data for the Snyk-based scanners. | Sign in at app.snyk.io, enable Snyk Code in the organisation settings, then create an API token in your account settings. |
| Shodan | What the internet sees on the hosts an OSINT scan finds: open services and known vulnerabilities. | The Shodan developer page: developer.shodan.io. |
| Dehashed | Leaked credentials for the domains an OSINT scan checks. | Your account at dehashed.com. |
Enter the values
- 01Open Teams from the user menu
If you belong to several teams, pick the right one in the team list at the top of the page first.
- 02Go to the tab and card
For example Integrations → Issue trackers → DefectDojo, or Scanning → Scanner engines → OpenVAS.
- 03Fill in the fields
Exactly as the service issued them. Leave a saved secret field empty to keep its value.
- 04Click Save in that block
The toast says Saved. Scanner engines, trackers and alerts then show Connected next to their name, and the Overview tab counts them under Integrations.
Typing an API key, password or bot token into these fields is a person's step.
An AI agent must not ask for these values in the chat.
Check: a saved block shows Connected, which means the values are stored; it does not test them. The first scan or export that uses the service shows whether it accepted them; DefectDojo exports are checked as described in Set up DefectDojo.
Last reviewed 2026-10-19