Understanding CSPM_URL Configuration for Supply Chain Security Integrations

Overview

When configuring GitLab or other code repository integrations for Aqua Supply Chain Security, the integration settings require a CSPM_URL value (for example, https://ap-2.api.cloudsploit.com). This requirement applies even when Cloud Security Posture Management (CSPM) is not licensed or in use.

This article explains what CSPM_URL represents, why it is required for SCM integrations, and how it relates to authentication for Supply Chain Security scanning components.

Understanding the CSPM_URL Setting

The CSPM_URL configuration parameter specifies the Aqua SaaS API endpoint for your region. Despite the name, this setting is not limited to CSPM functionality.

Key points:

  • CSPM_URL identifies the Aqua SaaS platform endpoint for your tenant region
  • The same endpoint is used across multiple Aqua SaaS services
  • Supply Chain Security integrations require this endpoint for authentication and result reporting
  • Enabling or licensing CSPM is not a prerequisite for setting this value

Why CSPM_URL Is Required for SCM Integration

Supply Chain Security scanning uses Trivy-based scanners that must authenticate with the Aqua SaaS platform and report findings back to your tenant. The CSPM_URL setting provides the base API endpoint used for this communication.

Authentication and API Access

The configured CSPM_URL endpoint supports:

  • Scanner authentication — Trivy-based scanners authenticate against the Aqua SaaS API to submit scan results
  • SaaS platform login — The same regional endpoint is used for Aqua console and API access
  • Bearer token generation — Workload Protection API and related integrations use this endpoint to obtain authentication tokens

Naming Convention

The parameter is named CSPM_URL for historical reasons. It was introduced to identify which regional Aqua SaaS API endpoint should be configured. The name does not indicate that CSPM functionality must be enabled.

In practice: Treat CSPM_URL as the Aqua SaaS API endpoint URL for your region, not as a CSPM-specific configuration.

Regional Endpoint Values

Configure CSPM_URL to match your Aqua SaaS tenant region:

RegionExample CSPM_URL
APAChttps://ap-2.api.cloudsploit.com
UShttps://api.cloudsploit.com
EUhttps://eu-1.api.cloudsploit.com

Use the endpoint that corresponds to your Aqua SaaS tenant. The correct value is available in your Aqua console under account or integration settings.

Configuration Example

When integrating a self-managed GitLab server with Supply Chain Security, the connection settings include:

CSPM_URL: https://ap-2.api.cloudsploit.com

This value enables the scanner to:

  1. 1. Authenticate with the Aqua SaaS platform
  2. 2. Submit vulnerability and supply chain scan findings
  3. 3. Associate results with the correct tenant and project

No additional CSPM module configuration is required for this integration to function.

Important Considerations

CSPM License Not Required

Organizations using only Workload Protection and Supply Chain Security (without CSPM) must still configure CSPM_URL. The setting provides the API endpoint for authentication — it does not activate or require CSPM features.

Endpoint Must Match Tenant Region

Using an incorrect regional endpoint causes authentication failures or prevents scan results from appearing in the console. Verify the endpoint matches your Aqua SaaS tenant region before completing the integration.

Shared Endpoint Across Services

The same CSPM_URL endpoint serves multiple Aqua SaaS capabilities:

  • Supply Chain Security scan result reporting
  • SaaS console authentication
  • Workload Protection API token generation
  • CSPM features (when licensed)

Verification

After configuring CSPM_URL for a GitLab SCM integration:

  1. 1. Complete the GitLab server connection in Supply Chain Security → Integrations
  2. 2. Run a test scan or trigger a pipeline scan
  3. 3. Verify scan results appear in the Aqua console under the associated repository or project
  4. 4. Confirm no authentication errors appear in scanner or pipeline logs

Expected outcome: Scan results are reported to Aqua SaaS without requiring CSPM to be enabled.

Platform Coverage

Applicable To:

  • Aqua Supply Chain Security (SaaS)
  • GitLab server and GitLab.com integrations
  • Self-managed and cloud-hosted code repository integrations

Affected Components:

  • Supply Chain Security scanner (Trivy-based)
  • Code repository integrations
  • CI/CD pipeline scanning

Summary

TopicDetails
What CSPM_URL isRegional Aqua SaaS API endpoint URL
Why it's requiredScanner authentication and scan result reporting
CSPM license needed?No — the name is historical, not functional
Common mistakeAssuming CSPM must be enabled because of the parameter name
Action requiredSet the correct regional endpoint for your tenant