Qovery application

Qovery is a Kubernetes infrastructure management and deployment platform. MIA connects to it to inventory users, send invitations, and manage the removal of their access.

Authentication type and prerequisites

Authentication type — API key

Prerequisites

Have a Qovery API token authorized to list organizations and roles, and to read, invite, and remove their users.

Token configuration

For a fine-grained token using a default allow := false policy, replace <ORGANIZATION_ID> with the organization UUID and add the following rules:

allowed_organization_id := "<ORGANIZATION_ID>"

allow if list_organizations
allow if read_organization_members
allow if delete_organization_member
allow if list_organization_roles
allow if manage_organization_invitations
allow if delete_organization_invitation

list_organizations if {
  input.request.method in {"GET", "HEAD"}
  input.request.path == ["api", "organization"]
}

read_organization_members if {
  input.request.method in {"GET", "HEAD"}
  input.request.path == [
    "api",
    "organization",
    allowed_organization_id,
    "member",
  ]
}

delete_organization_member if {
  input.request.method == "DELETE"
  input.request.path == [
    "api",
    "organization",
    allowed_organization_id,
    "member",
  ]
}

list_organization_roles if {
  input.request.method in {"GET", "HEAD"}
  input.request.path == [
    "api",
    "organization",
    allowed_organization_id,
    "availableRole",
  ]
}

manage_organization_invitations if {
  input.request.method in {"GET", "POST"}
  input.request.path == [
    "api",
    "organization",
    allowed_organization_id,
    "inviteMember",
  ]
}

delete_organization_invitation if {
  input.request.method == "DELETE"
  [
    "api",
    "organization",
    allowed_organization_id,
    "inviteMember",
    _,
  ] = input.request.path
}

These rules only allow organization and role listing, member and invitation reading, invitation creation, and member or invitation removal.

Adding a user from MIA sends an invitation with the selected role. For security reasons, the invited user must accept it using their own Qovery account; MIA's organization token cannot accept it on their behalf.

Connection steps

1. In the Qovery console, open your organization settings, then API Token.
2. Create a token with the required permissions, configure its policy as shown above, and copy it.
3. In MIA, open Applications → Add an application, search for Qovery, enter the token, then click Connect.
4. Select the organization to synchronize from the proposed list.

::: Official source Qovery documents its API authentication, role listing endpoint, user invitation endpoint, and member removal endpoint. :::