> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/akeyless.md).

# Akeyless

Import Akeyless secrets into Veza from a CSV file, and connect them to leaked secrets found by GitHub Secret Scanning.

{% hint style="info" %}
The Secret Store CSV template might not be enabled for your Veza tenant by default. If creating the integration fails with a "not enabled" error, contact Veza Support.
{% endhint %}

**Available in Veza v2026.10.19 and later.**

## Overview

Akeyless is a secrets management platform. Veza imports Akeyless secrets from a CSV export, using the [CSV Upload](/4yItIzMvkpAvMVFAamTf/integrations/integrations/csv.md) **Secret Store** template. Each secret becomes a vault entry in Veza, grouped into vaults, so you can search for the secrets, review their tags and expiration dates, and include them in queries. Veza imports metadata about each secret. The template has no field for secret values.

If you also use [GitHub Secret Scanning](/4yItIzMvkpAvMVFAamTf/integrations/integrations/github.md), Veza connects leaked AWS access keys, LDAP bind credentials, and SQL Server logins found in your repositories to the Akeyless entries that hold them. See [Connect leaked secrets to Akeyless entries](#connect-leaked-secrets-to-akeyless-entries).

The import creates these entities:

* **Custom Secret Store**: The Akeyless instance
* **Custom Secret Store Vault**: A group of secrets. If no vault columns are mapped, all secrets are placed in one vault named **Default**.
* **Custom Secret Store Vault Entry**: A secret

## Prerequisites

* A CSV export of the Akeyless secrets to import, with one row per secret and a header row. See [Format Requirements](/4yItIzMvkpAvMVFAamTf/integrations/integrations/csv.md#format-requirements).
* To connect leaked secrets: the tags described in [Connect leaked secrets to Akeyless entries](#connect-leaked-secrets-to-akeyless-entries), added to the secrets in Akeyless before you export

## Import Akeyless secrets

1. Go to **Integrations** > **Add Integration**, and choose **Upload CSV**.
2. Enter an integration name, such as "Akeyless - Production".
3. Select the **Secret Store** template.
4. Enter the template fields:
   * **Secret Store Name**: A name for the Akeyless instance.
   * **Secret Store Type**: Enter `akeyless`. The value isn't case-sensitive.
   * **Vault Type**: Optional. A vault type for vaults that don't have a mapped vault type column.
5. Upload the CSV file.
6. Map the CSV columns to vault and entry attributes. Map at least an entry ID or name. See [Example CSV file](#example-csv-file).
7. Click **Create Integration**.

To update the secrets in Veza, push a new CSV file to the integration. See [Updating a CSV Integration](/4yItIzMvkpAvMVFAamTf/integrations/integrations/csv.md#updating-a-csv-integration).

## Example CSV file

This example shows one LDAP bind credential and one SQL Server login. Column names vary by export, so map each column in your file to the attribute it holds. Only an entry ID or name is required. All other columns are optional.

```csv
folder,path,name,expires_at,tags
/prod/ldap,/prod/ldap/svc-reports,svc-reports,2027-03-31,bind_identity=svc-reports|ldap_host=corp.example.com|env=prod
/prod/mssql,/prod/mssql/app-reader,app-reader,never,sql_login=app_reader|mssql_host=sql01.example.com|env=prod
```

| CSV column   | Entity | Attribute  |
| ------------ | ------ | ---------- |
| `folder`     | Vault  | Name       |
| `path`       | Entry  | ID         |
| `name`       | Entry  | Name       |
| `expires_at` | Entry  | Expires At |
| `tags`       | Entry  | Tags       |

Each row becomes one vault entry, and the `folder` column groups the entries into vaults. The import creates two vaults, `/prod/ldap` and `/prod/mssql`, each holding one entry: `svc-reports` and `app-reader`. The `never` expiration date is ignored. For every attribute and the rules that can fail an upload, see [Secret Store Template Entities](/4yItIzMvkpAvMVFAamTf/integrations/integrations/csv.md#supported-entity-types-and-attributes).

## Connect leaked secrets to Akeyless entries

When GitHub Secret Scanning finds a leaked AWS access key, LDAP bind credential, or SQL Server login, Veza connects the leaked secret to the Akeyless entries tagged with the same access key ID or account, with a **Matches Credential** relationship.

Akeyless doesn't add these tags. Before exporting, add the tag for each secret's credential type in Akeyless, and map the tag column to the entry's **Tags** attribute.

* **AWS access keys**: an `aws_key_id` tag whose value is the AWS access key ID, such as `AKIAIOSFODNN7EXAMPLE`. A leaked secret access key matches only when GitHub Secret Scanning also finds its access key ID within a few lines of it.
* **LDAP bind credentials**: a `bind_identity` or `bind_cn` tag whose value is the account name only, such as `svc-reports`. Use the same tag name on all LDAP secrets.
* **SQL Server logins**: a `sql_login` tag whose value is the SQL Server login, such as `app_reader`.

For an LDAP tag, don't use the full distinguished name (`CN=svc-reports,OU=Service Accounts,DC=corp,DC=example,DC=com`) or the `DOMAIN\user` form. Veza matches the account name that follows `CN=`, `UID=`, or `sAMAccountName=` in the leaked credential, so account names that contain spaces can't be matched.

For example, a tags cell that holds only `env=prod` has no credential tag. With the credential tag added, the cell is `bind_identity=svc-reports|env=prod` for an LDAP secret, `sql_login=app_reader|env=prod` for a SQL Server login, or `aws_key_id=AKIAIOSFODNN7EXAMPLE|env=prod` for an AWS access key.

{% hint style="info" %}
Correlation is only as complete as your tags. Veza connects a leaked secret only to entries tagged with its identifier, or with a Key ID equal to it. If some secrets are missing the tag, or have the wrong value, leaked credentials for those secrets aren't connected.
{% endhint %}

With the `akeyless` Secret Store Type, Veza also builds each entry's Key IDs from its `bind_identity` and `sql_login` tags, and from `bind_dn`, `ldap_host`, `mssql_host`, and `mssql_port` tags when present. See [Key IDs built from vendor properties](/4yItIzMvkpAvMVFAamTf/developers/api/oaa/templates/secret-store-template.md#key-ids-built-from-vendor-properties).

See [Secret Store tags](/4yItIzMvkpAvMVFAamTf/integrations/integrations/csv.md#secret-store-tags) for every supported tag format, and [Leaked secret correlation](/4yItIzMvkpAvMVFAamTf/developers/api/oaa/templates/secret-store-template.md#leaked-secret-correlation) for every credential type, tag name, and the order Veza checks them in.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/akeyless.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.