The Envoy integration enables security and compliance teams to automate User Access Reviews (UAR) by syncing user access data directly from Envoy. This helps organizations review who has access to Envoy and maintain accurate access records for compliance monitoring.
Key Capabilities
User Access Review Data Sync: Import Envoy user account data into Drata
Access Governance: Monitor which users have access to your Envoy environment
Compliance Monitoring: Maintain visibility into system access to support audit and compliance workflows
This integration supports User Access Review workflows, helping demonstrate compliance with access control policies.
Prerequisites & Data Access
Envoy Access Requirements
You must have Admin privileges in your Envoy organization.
You must create an Envoy application and retrieve the Client API Key.
The application must include the required API scope.
Drata Role Requirements
To create or modify connections, you must have one of the following Drata roles with write access: Admin, Workspace Manager, or DevOps Engineer
Access Reviewers can view the connection page but cannot create or modify connections
Permissions & Required Access
Permission / Scope | Why It’s Needed |
| Allows Drata to retrieve employee and user access information from Envoy |
Client API Key | Authenticates the integration with Envoy |
Step-by-Step Setup
Step 1: Create an Envoy Application
Log in to your Envoy account.
In the left navigation menu, select Apps.
Open the Dev Dashboard.
Select Create New to create a new application.
Enter an application name.
Expected outcome:
A new Envoy application is created.
Step 2: Configure Application Permissions
In the application configuration settings, select the following API scope:
employees.readDo not select any options under Where will customers install your app?.
Save the application.
Expected outcome:
The Envoy application is configured with the required API permissions.
Step 3: Retrieve the Client API Key
After saving the application, locate the Client API Key.
Copy the key and store it securely.
Expected outcome:
You have copied the Client API Key required to authenticate the integration.
Step 4: Connect Envoy in Drata
Log in to Drata → go to the Connections page.
Navigate to your Available Connections.
Search for and start the Envoy connection process.
Enter the Client API Key when prompted.
Expected outcome:
Envoy is successfully connected and user access data begins syncing to Drata.
Important Notes
Authentication method: The Envoy integration uses an API key generated from the Envoy Developer Dashboard.
Required scope: The application must include the employees.read permission.
Security best practice: Store API credentials securely and rotate them according to your organization’s security policies.
Network restrictions: If your organization uses a Web Application Firewall (WAF), ensure required Drata IP addresses are allowlisted so the connection can be established.