Ctrlk
Sprinto DashboardAPI Reference
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Github App Integration

Connect the GitHub App to Sprinto to automatically monitor repositories, access controls, and security checks for continuous compliance.

The GitHub App integration enables Sprinto to continuously monitor your GitHub organisation for repository activity, access controls, and security configurations.

Sprinto uses this integration to automate compliance checks such as:

  • Multi-factor authentication (MFA) enforcement

  • Repository access reviews

  • Branch protection and peer review enforcement

  • Dependabot vulnerability monitoring

The integration supports two connection methods:

  • Sprinto GitHub App (recommended) — Quick setup using Sprinto’s pre-configured app

  • Bring Your Own GitHub App — Custom setup for enterprise or restricted environments

How it Works

The integration uses GitHub Apps with read-only permissions to securely fetch compliance data.

  1. You initiate the connection from Sprinto.

  2. You choose a connection method.

  3. GitHub permissions are granted at the organisation level.

  4. Sprinto generates installation access tokens.

  5. Data is retrieved using GitHub REST and GraphQL APIs.

  6. Controls and checks are continuously evaluated.

Note

The integration relies on read-only GitHub App permissions aligned with Sprinto’s production configuration to ensure secure and non-intrusive access.

Sprinto checks for GitHub

The below procedure below has a dedicated section for configuring GitHub as a change management and ticketing system. You can follow the section that applies to your GitHub Usage:

Sprinto check
Check description
Reference procedure

GitHub org level MFA should be enforced

Multi-factor authentication (MFA) should be enforced at the organization level.

How to fix

GitHub user should have MFA enabled

Multi-factor authentication (MFA) should be enabled on all users' accounts

How to fix

Github access should be removed for offboarded user

Revoke access from the organization’s GitHub account for every offboarded staff member.

How to fix

Dependabot vulnerability scan should be enabled

Enable the Dependabot vulnerability scan on your GitHub repositories.

How to fix

Peer review should be enforced for code changes

Peer review should be enforced on every change merging request on the main branch.

How to fix

Merging of code changes should require passing status-checks

Every code change must pass the status check.

How to fix

Branch Protection rules should be enforced for admins

The branch protection ruleset should be configured on the GitHub account.

How to fix

Code changes should be reviewed by peers before merging

Every code change should be reviewed by a peer reviewer.

How to fix

Supported GitHub Environments

Sprinto supports integration with:

  • GitHub Cloud (github.com)

  • GitHub Enterprise Cloud (*.ghe.com)

  • GitHub Enterprise Server (self-hosted)

Use Bring Your Own GitHub App for enterprise or data residency requirements.

Required Permissions

To align with Sprinto’s production GitHub App configuration, grant the following read-only permissions:

Repository Permissions

  • Metadata — Read-only

  • Administration — Read-only

  • Checks — Read-only

  • Dependabot alerts — Read-only

  • Pull requests — Read-only

Organisation Permissions

  • Administration — Read-only

  • Members — Read-only

These permissions allow Sprinto to monitor repository activity, access configurations, and security posture without making any changes.

What Data Sprinto Accesses

Sprinto retrieves the following data:

  • Installation ID

  • Organisation details

  • Repositories and branches

  • Commits and pull requests

  • Organisation members and collaborators

  • MFA status

  • Dependabot vulnerability alerts

APIs Used by Sprinto

Sprinto uses GitHub APIs to retrieve compliance data securely.

REST API Endpoints

Endpoint
Purpose

GET /app

Validate app credentials

GET /app/installations/{installationId}

Retrieve installation details

POST /app/installations/{installationId}/access_tokens

Generate access tokens

GET /orgs/{org}

Fetch organisation details

GET /orgs/{org}/members

List organisation members

GET /orgs/{org}/outside_collaborators

List external collaborators

GET /orgs/{org}/repos

List repositories

GET /users/{username}

Fetch user details

GET /repos/{owner}/{repo}/pulls

Retrieve pull requests

GraphQL API

Sprinto also uses GitHub’s GraphQL API (https://api.github.com/graphql) to:

  • Query organisation members with roles

  • Retrieve SSO/SAML identity information

  • Fetch commit history and pull request data

  • Access vulnerability and security alerts

Important Considerations

  • Selecting specific repositories limits monitoring scope.

  • Missing repositories are usually due to restricted selection.

  • Reinstallation is required to update repository access.

Before you begin

Ensure the following prerequisites are met:

  • You have Admin access to the GitHub organisation where the app will be installed.

  • You are logged in to the Sprinto Admin Portal.

  • Your GitHub organisation allows third-party GitHub Apps to be installed.

How it works

The integration works in three stages:

  1. You initiate the connection from Sprinto.

  2. You install the Sprinto Audit GitHub App in your GitHub organisation.

  3. Sprinto syncs repository and organisation-level data to automate compliance checks.

The connection type used is OAuth.

Dashboard Actions

Connect GitHub App

  1. Log in to the Sprinto dashboard.

  2. Navigate to Settings → Integrations.

  3. In the All tab, search for GitHub App.

  4. Click Connect.

  1. Review:

    • Controls automated

    • Checks covered

    • Permissions required

    • Data accessed by Sprinto

  2. Click Next.

Choose Authentication Method

Option 1: Use Sprinto’s GitHub App (Recommended)

Use Sprinto’s pre-configured GitHub App for a quick setup.

  1. Select Use Sprinto’s GitHub App.

  2. Click Connect with Sprinto.

  1. You will be redirected to GitHub.

  2. Sign in and authorise the Sprinto Audit app.

  1. Select:

    • Organisation

    • Repository access (All or Selected)

  2. Click Install.

After installation:

  • You are redirected back to Sprinto

  • Initial sync begins automatically

  • Integration status updates to Active

Option 2: Bring Your Own GitHub App

Use this method for GitHub Enterprise or custom configurations.

Step 1: Create a GitHub App

  1. Select Bring Your Own GitHub App.

  2. Click Continue.

  1. In your Github account, go to Settings → Developer settings → GitHub Apps.

  2. Click New GitHub App.

  1. Enter:

    • App name: sprinto-audit-app

    • Homepage URL: Use your Sprinto region:

    • Callback URL: Use your Sprinto region:

      • India: http://in.sprinto.com/githubapp/githubAppCallback

      • EU: http://eu.sprinto.com/githubapp/githubAppCallback

      • US: http://app.sprinto.com/githubapp/githubAppCallback

      • AU: https://au.sprinto.com/githubapp/githubAppCallback

    • Setup URL (Post Installation):

      • India: http://in.sprinto.com/githubapp/githubAppCallback

      • EU: http://eu.sprinto.com/githubapp/githubAppCallback

      • US: http://app.sprinto.com/githubapp/githubAppCallback

      • AU: https://au.sprinto.com/githubapp/githubAppCallback

  1. Configure the required permissions.

  2. Click Create GitHub App.

  1. After creation:

    1. Note the App ID

    2. Copy the Public Link

  1. Scroll down to the Private Keys section.

  2. Click Generate a private key.

Configure IP Allowlist (Required)

After creating your GitHub App, you must allow Sprinto’s public IP addresses if your organisation enforces IP restrictions.

Add the following IP addresses to your allowlist based on your Sprinto region:

Region
Domain
Public IP

US

app.sprinto.com

54.193.221.51

India

in.sprinto.com

3.108.123.60

EU

eu.sprinto.com

18.184.125.204

AU

au.sprinto.com

54.252.98.100

Important

Ensure these IP addresses are added to your organisation’s IP allowlist to enable successful communication between Sprinto and GitHub.

Step 2: Add Credentials in Sprinto

  1. Enter:

    • App Public Link

    • App ID

    • Private Key

  2. Click Test Connection.

  3. Once validated, click Connect.

  1. You will be redirected to GitHub, select the user to authorise your GitHub app.

  2. Click Continue.

  1. Click Install to install your app.

Sprinto will establish the connection and begin syncing data.

Complete integration

After installation:

  • You will be redirected back to Sprinto.

  • Sprinto will initiate the initial sync.

  • The GitHub App status will update to Active once connected.

The integration is now complete.

Troubleshooting

  1. Unable to install the app

    • Ensure you have organisation admin access in GitHub.

    • Check whether your organisation restricts third-party app installations.

  2. Integration shows inactive

    • Confirm the app is installed in the correct organisation.

    • Verify repository access selection.

    • Try reconnecting from Settings → Integrations.

  3. Missing repositories in Sprinto

    • If “Only select repositories” was chosen, ensure the required repositories were selected.

    • Reinstall the app and modify repository access if needed.

Support

Contact Sprinto support if you have any queries regarding the integration or need any assistance.

PreviousGithub + Dependabot IntegrationNextGithub Issues Integration

Last updated