Skip to main content

How to set up Cyera

Setup takes about 5 minutes.

Introduction

Connecting Cyera to Foundational brings Cyera's sensitive data findings into the Foundational lineage graph. Each Cyera issue and classification is attached to the exact tables and columns it affects, so you can see where the sensitive data came from, which code and transformations produced it, who owns that code, and every downstream table, report, model and AI agent that reads it.

With the integration enabled, you can:

  • Trace a Cyera finding upstream to the source system, pipeline, commit and code owner that introduced it.
    ​

  • See the downstream blast radius of a finding before you remediate it.
    ​

  • Flag or block pull requests that move Cyera-classified columns to new or unapproved targets.
    ​

  • Queue a targeted Cyera rescan of a datastore after a merged code change, instead of waiting for the next scheduled scan.
    ​

  • Ask questions about classified data in Foundational IQ, or query it from your AI tools over the Foundational MCP server.

The connection process has three parts:

  • Part 1: Create Cyera API credentials
    ​

  • Part 2: Connect Cyera in Foundational
    ​

  • Part 3: Enable build-time checks and rescans (optional)

How the integration works

The integration is bi-directional and uses the Cyera REST API.

Direction

What flows

How

Cyera to Foundational

Issues (type, severity, status, affected datastore, objects and columns, data classes), datastore classifications, datastore scanning state and last scan time

Foundational polls the Cyera API on a configurable schedule

Foundational to Cyera

Rescan requests for datastores affected by a merged code change

Foundational queues the datastore for scanning, then polls its scanning state until it reaches Scanned

Foundational resolves each Cyera datastore, object and column to the matching node in its lineage graph, using the platform, host, database, schema and object identifiers. Matched columns show the Cyera classification, data class, last scanned date and findings in the Data Security section of the entity panel. Assets with findings carry a Security Issue tag across lineage, search and the data catalog.

Foundational reads code and metadata only. It never reads, samples or copies the contents of your datastores, and it never changes labels, policies or access in Cyera.

Prerequisites

Ensure you have:

  • A Cyera user with the DSPM Viewer role or higher, and permission to create API tokens. To use event-driven rescans, the credential also needs permission to send datastores to scan.
    ​

  • An admin user in Foundational.
    ​

  • Lineage coverage in Foundational for the datastores Cyera scans. Connect the Git repositories that hold the pipeline code and the data platforms themselves (for example, Snowflake, Databricks or BigQuery).
    ​

  • Outbound HTTPS (port 443) from Foundational to your Cyera API endpoint. If your Cyera tenant restricts API access by IP address, add the Foundational IP addresses listed in Allowing IP access to Foundational.

Access permissions

The Cyera API credential you create enables Foundational to:

  • Read Cyera issues and their affected datastores, objects and columns.
    ​

  • Read datastore classifications.
    ​

  • Read datastore metadata, including scanning state and last scan time.
    ​

  • Queue a datastore for scanning (only when event-driven rescans are enabled).

Foundational stores the client ID and client secret encrypted, and never displays the secret after you save it.

Part 1: Create Cyera API credentials

  1. Log in to the Cyera console at app.cyera.io.
    ​

  2. Go to Settings > Integrations.
    ​

  3. Search for Foundational and open its card.
    ​

  4. Click Generate Token.
    ​

  5. Copy the Client ID and Client Secret and store them securely.

Warning: Cyera shows the client secret only once. If you lose it, generate a new token.

Part 2: Connect Cyera in Foundational

  1. In Foundational, open the Connectors & Integrations page.
    ​

  2. In DSPM, select the Cyera card and click Connect.
    ​

  3. A screen opens. Click Add Account. The Set Up New Connection screen opens.
    ​

  4. Complete the connection details:

    • Cyera API URL: The API endpoint for your Cyera tenant, for example https://api.cyera.io.
      ​

    • Client ID: From Part 1.
      ​

    • Client Secret: From Part 1.

  5. Click Test Connection. Foundational exchanges the credentials for a short-lived token and lists the datastores it can see. If the check fails, the error appears here.
    ​

  6. Select the Cyera datastores or environments to sync, and set the sync schedule.
    ​

  7. Click Save. The first sync starts automatically.

The Cyera card now shows Connected. Open it to see each connected account with its Cyera role (for example, DSPM Viewer). Use Add Account to connect additional Cyera tenants.

Part 3: Enable build-time checks and rescans (optional)

  1. In the Cyera connector settings, turn on Build-time policy to flag pull requests that move Cyera-classified columns to new or unapproved targets. Choose Warn to comment on the pull request, or Block to fail the check.
    ​

  2. Turn on Rescan after merge to queue a Cyera rescan of each monitored datastore affected by a merged change.
    ​

  3. Click Save.

Build-time checks require a connected source control provider with pull request comment permission. See How to set up GitHub, GitLab, Bitbucket or Azure Repos.

Verify the connection

  1. Open the Lineage page. In Recent Places and in search results, assets with a Cyera finding carry a red Security Issue tag. Lineage graph nodes with a finding show a red marker.
    ​

  2. Open a column with a Cyera finding. In the entity panel, expand Data Security. The Cyera block shows the classification (for example, Privileged), the data class (for example, Credit Card Number), when Cyera last scanned it, and each finding with its severity.
    ​

  3. From the same panel, open Upstream to trace the column to its origin and the code that produced it, and Downstream to see every consumer. Confirm the finding resolves to the correct table and column.
    ​

  4. If you enabled Part 3, open a test pull request that writes a classified column to a new table. Foundational comments on the pull request with the classified columns and their downstream impact. After you merge, the datastore appears in Cyera with scanning state Pending, then Scanning, then Scanned.

Scan verdicts

For each dataset or pipeline run that Cyera covers, Foundational records one of three verdicts:

Verdict

Meaning

No target sensitive data detected

A completed Cyera scan covered the dataset after the most recent relevant change, and found no data in the target classes.

Target sensitive data detected

A Cyera scan found data in the target classes.

Inconclusive

The scan is pending, incomplete or stale, or coverage of the dataset is insufficient.

Foundational never treats zero issues or an empty classification response as proof that a dataset is clean. A clean verdict requires a completed scan that covers the dataset.

Validation and troubleshooting

Symptom

Cause / fix

Test Connection fails with an authentication error

The client ID or secret is wrong, or the token was revoked. Generate a new token in Cyera (Part 1) and enter it again.

A Cyera issue appears without lineage

Foundational does not cover that datastore, or its identifiers do not match. Connect the missing Git repository or data platform. Unmatched datastores are listed in the connector's unmatched datastores report.

A dataset stays Inconclusive

The rescan is still queued or running. Cyera queues and prioritises rescans, so the result is not immediate. Wait for the scanning state to reach Scanned, or confirm the result in Cyera.

Rescans are not requested after merge

The credential lacks permission to send datastores to scan, or Rescan after merge is off. Check the Cyera role and the connector settings.

New Cyera findings are missing

Findings sync on a schedule. Wait for the next sync, or shorten the sync interval.

Limitations

  • Classifications are shown on the columns Cyera classified. Foundational shows downstream exposure as lineage impact and does not create new labels on derived columns.
    ​

  • Lineage context is viewed in Foundational. To use it elsewhere, use the Foundational API, the MCP server or the OpenLineage export.
    ​

  • Foundational does not trigger remediation actions inside Cyera, such as access revocation or labeling.
    ​

  • Datastores with no code path, such as file shares, SaaS documents or email, have no code lineage. Their Cyera findings appear without lineage.

That's it. Foundational is now connected to Cyera.

Useful links

Related Articles
Did this answer your question?