# Self-Hosted GitLab Integration

Self-hosted GitLab enables organisations to manage source code, CI/CD pipelines, and collaboration within privately hosted infrastructure.

The Sprinto self-hosted GitLab integration allows you to:

* Monitor production-classified repositories
* Enforce peer review before merges
* Validate status checks before merging
* Enforce branch protection rules
* Verify group-level MFA
* Detect and remove offboarded user access

Self-hosted GitLab supports **Change Management only**.

{% hint style="info" %}
Sprinto uses **read-only access** and does not read or store repository code.
{% endhint %}

#### Sprinto checks for Gitlab integration <a href="#sprinto-checks-for-gitlab-integration" id="sprinto-checks-for-gitlab-integration"></a>

Following are the available Sprinto checks for GitLab integration:

<table><thead><tr><th>Sprinto check</th><th width="379.6171875">Description</th><th>Reference procedure</th></tr></thead><tbody><tr><td>Gitlab group-level MFA should be enforced</td><td>Enable group-level MFA enforcement on your Gitlab account.</td><td><a href="../../monitors/authentication-and-access-monitors/enforce-org-level-and-root-level-mfa">How to fix</a></td></tr><tr><td>Peer review should be enforced for code changes</td><td>Peer review should be configured on each GitLab repository classified as “Production” on Sprinto.</td><td><a href="../../monitors/code-and-repository-monitors/pr-reviewer-is-different-from-author">How to fix</a></td></tr><tr><td>Merging of code changes should require passing status-checks</td><td>All change merge request should pass the status check prior.</td><td><a href="../../monitors/code-and-repository-monitors/how-to-resolve-sprinto-check-for-enabling-branch-protection-rules">How to fix</a></td></tr><tr><td>Branch Protection rules should be enforced for admins</td><td>Configure branch protection rules for admins on your GitLab account.</td><td><a href="../../monitors/code-and-repository-monitors/how-to-resolve-sprinto-check-for-enabling-branch-protection-rules">How to fix</a></td></tr><tr><td>Code changes should be reviewed by peers before merging</td><td>Code changes must be reviewed by a peer reviewer before merging the changes to the main branch.</td><td><a href="../../monitors/code-and-repository-monitors/how-to-resolve-sprinto-check-for-enabling-branch-protection-rules">How to fix</a></td></tr><tr><td>GitLab access should be removed for offboarded user</td><td>GitLab access should be revoked for any off boarding staff member.</td><td><a href="../../monitors/authentication-and-access-monitors/resolve-sprinto-check-for-removing-access-for-offboarded-users">How to fix</a></td></tr></tbody></table>

## How It Works

The integration uses an OAuth application created in your self-hosted GitLab instance.

1. You create a GitLab OAuth application.
2. You configure redirect URLs and scopes.
3. You provide Sprinto with:
   * Hosted service URL
   * Application ID
   * Client Secret
4. Sprinto securely connects and begins monitoring repository configuration metadata.

Sprinto evaluates configuration settings only. It does not modify repositories.

***

## Before You Begin

Ensure that:

* You have a **paid self-hosted GitLab account**.
* You have **Admin access** to the GitLab instance.
* Sprinto’s IP address is allowlisted if your instance is not publicly accessible.
* You can create OAuth applications in GitLab.

***

## Permissions Required (OAuth Scopes)

When creating the OAuth application in GitLab, select:

* `read_api`
* `read_repository`
* `read_user`
* `profile`

These permissions allow Sprinto to:

* Read groups and projects
* Evaluate branch protection rules
* Validate peer review enforcement
* Retrieve user access metadata

Sprinto does not request write access.

***

## Dashboard Actions

### Step 1: Create an OAuth Application in Self-Hosted GitLab

1. Log in to your self-hosted GitLab instance.
2. Click **Menu**.
3. Select **Admin**.
4. Go to **Applications**.
5. Click **New application**.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FPZXhiy7MHLcBAO5iOY24%2Fgittu1.png?alt=media&#x26;token=d005d4c8-3c69-41c6-9b77-3ac94059e6e0" alt="" width="563"><figcaption></figcaption></figure>

#### Enter the following details:

**Name**\
Sprinto Audit

#### Redirect URL (Based on Region)

Enter one URL per line.

<table><thead><tr><th width="99.71484375">Region</th><th width="459.76953125">Redirect URL</th></tr></thead><tbody><tr><td>Europe</td><td>https://eu.sprinto.com/oauth2/authorizationHandler</td></tr><tr><td>India</td><td>https://in.sprinto.com/oauth2/authorizationHandler</td></tr><tr><td>Others</td><td>https://app.sprinto.com/oauth2/authorizationHandler</td></tr><tr><td>Australia</td><td>https://au.sprinto.com/oauth2/authorizationHandler</td></tr></tbody></table>

#### Select the following options:

* Trusted
* Confidential
* Expire access tokens

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FtoTcWZBEr3NSgIWfwrKd%2Fgittu2.png?alt=media&#x26;token=4de75a09-53fd-4f1f-8fc3-785743893690" alt="" width="563"><figcaption></figcaption></figure>

#### Select these scopes:

* `read_user`
* `read_api`
* `read_repository`
* `profile`

Click **Save**.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2F5JOmRdVMKRh3Jgvull3f%2Fgittu3.png?alt=media&#x26;token=d8769d16-707a-4319-ac13-fb0daf0d5edc" alt="" width="563"><figcaption></figcaption></figure>

After saving:

* Copy the **Application ID.**
* Copy the **Secret.**
* Store them securely.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2Fhcn0tGvQOZ25rqK2Ccns%2Fgittu4.png?alt=media&#x26;token=46782357-a507-42d3-854c-6420426b1f75" alt="" width="563"><figcaption></figcaption></figure>

***

### Step 2: Connect Self-Hosted GitLab in Sprinto

1. Log in to Sprinto.
2. Navigate to **Settings > Integrations**.
3. In the **All** tab, search for **GitLab**.
4. Click **Connect** next to GitLab (Version Control | Access Review).

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FBzKcETJaOebtCr3pLrCF%2FScreenshot%202026-02-26%20at%2016.28.35.png?alt=media&#x26;token=bdf9811f-f425-4d63-ad2d-ff1ac7d2f787" alt="" width="563"><figcaption></figcaption></figure>

#### Review Permissions

In the connection drawer:

* Review permissions required.
* Review data used by Sprinto.
* Click **Next**.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FMeNqw7mmJmgF6osbjhik%2FScreenshot%202026-02-26%20at%2016.31.01.png?alt=media&#x26;token=87a38dbc-c038-43b3-98ef-b23a694fd715" alt="" width="375"><figcaption></figcaption></figure>

***

### Step 3: Select Self-Hosted GitLab

On the Setup GitLab Integration screen:

You will see:

* Connection type: OAuth
* Prerequisites

#### Select:

**Are you using self-hosted GitLab Service?**

When selected, the following fields appear:

* **Hosted service URL**
* **Application ID**
* **Client Secret**

If you deselect this checkbox, these fields disappear and the integration defaults to GitLab Cloud.

<figure><img src="https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FmZiy0chZsCxutptlCxFh%2FScreenshot%202026-02-26%20at%2016.31.49.png?alt=media&#x26;token=2d388a9a-93bc-40fa-b110-94aece4cf2d6" alt="" width="375"><figcaption></figcaption></figure>

***

#### Enter the following:

**Hosted Service URL**\
Enter your domain without `http://` or `https://`.

Example:\
If your hosted URL is:\
`https://gitlab.company.com`

Enter:\
`gitlab.company.com`

**Application ID**\
Enter the ID copied from GitLab.

**Client Secret**\
Enter the secret copied from GitLab.

Review your details and click **Connect**.

You are now successfully integrated with self-hosted GitLab.

***

## IP Allowlist (If Required)

If your hosted GitLab instance is restricted, allowlist the appropriate Sprinto IP:

| Domain          | Region       | IP Address     |
| --------------- | ------------ | -------------- |
| app.sprinto.com | USA          | 54.193.221.51  |
| in.sprinto.com  | Asia Pacific | 3.108.123.60   |
| eu.sprinto.com  | Europe       | 18.184.125.204 |
| au.sprinto.com  | Australia    | 54.252.98.100  |

***

## Post-Connection Configuration

After connecting, configure GitLab as a Change Management system.

### Configure GitLab for Change Management

1. Navigate to **Data Library > Change Management**.
2. Click **Add system**.
3. Click **Add** next to GitLab.
4. Select repositories to monitor.
5. Save your changes.

Sprinto will monitor:

* Peer review enforcement
* Merge request status checks
* Branch protection rules
* MFA enforcement
* Offboarded user access removal

***

## Sync Timeline

After configuration:

* Initial sync begins automatically.
* Allow **15–20 minutes** for initial data sync.
* Full evaluation may take up to **24 hours**.

To manually refresh:

1. Navigate to **Data Library > Change Management > GitLab**.
2. Click **Sync**.

***

## Sprinto Checks Supported

This integration validates:

* GitLab group-level MFA enforcement
* Peer review before merge
* Mandatory passing status checks
* Branch protection enforcement for admins
* Offboarded user access removal

***

## Troubleshooting

#### Hosted service URL not accepted

* Remove `http://` or `https://`.
* Ensure the domain is reachable from Sprinto.
* Verify firewall rules.

#### Connection fails after clicking Connect

* Confirm Application ID and Client Secret are correct.
* Verify redirect URL exactly matches your Sprinto region.
* Confirm scopes are correctly selected.

#### No repositories appear

* Ensure repositories belong to accessible groups.
* Confirm the OAuth application has required scopes.
* Trigger a manual sync.

#### Integration connected but checks not running

* Ensure GitLab is added under Change Management.
* Allow up to 24 hours for evaluation.
* Confirm repositories are properly classified in Sprinto.

Contact [Sprinto support](mailto:www.support@sprinto.com) if you have queries related to the integration or need any assistance.