GitLab
GitLab OAuth scopes, cloud and self-managed setup boundaries, evidence outputs, and troubleshooting.
GitLab
Noru connects to GitLab through OAuth for cloud or configured self-managed instances. The integration uses GitLab read scopes for user and API evidence.
read_api is broad read access
GitLab read_api is a broad read scope across API resources visible to the
connected user. Limit effective access through the GitLab user, group, and
project membership you use for the connection.
Permission reference
Prop
Type
Setup
read_api and read_user scopes.What Noru collects
- user and account context for the connected GitLab identity
- groups, projects, repository metadata, and SDLC evidence visible through the API
- issue, merge request, pipeline, security, or configuration evidence where supported by the collector
What Noru does not collect
- write access to GitLab resources
- secrets or CI/CD variable values
- repository file contents unless the GitLab API scope and collector implementation explicitly request them
Evidence produced
GitLab evidence supports repository inventory, change management, code review, CI/CD, access review, and security controls.
Troubleshooting
Disconnect behavior
Disconnecting stops future syncs. Revoke the OAuth application grant in GitLab to remove provider-side authorization.
Scope minimization
Use a dedicated GitLab user or app configuration with access only to in-scope groups and projects.