Security, access, and API

Last updated: October 12, 2026

Collection: Getting Started · Title: Security, access, and API

Span gives admins control over who signs in, what each person can see, and how your data is handled, plus an API and MCP server for using Span data in your own tools.

Why it matters

Engineering data is sensitive. Security and IT teams need to know how access is controlled and what leaves developer machines before they approve a new tool. This article answers the questions they ask most.

How it works

Sign-in and access

Single sign-on (SAML). Your team signs in through your identity provider. Once SSO is on, email and password sign-in is turned off.
SCIM provisioning. Works with Okta, Microsoft Entra ID, Google Workspace, and other SCIM-compatible providers. Assigning or removing someone in your identity provider grants or removes their Span access.
Roles and permissions. Span uses role-based access control. Built-in roles include Owner, Admin, Manager, Team Lead, and Team Member, and you can create custom roles. Each permission is scoped to the whole organization, specific teams, specific people, or the user's own data. Managers are assigned automatically from reporting lines.

People and team data

Span builds its roster from your HRIS, a CSV upload, or a directory sync through the Span API. Directory sync combines sources, stages the changes, and waits for an admin to approve them before anything updates.

Span API

The Knowledge Graph API lets scripts, dashboards, and agents query pull requests, issues, deployments, teams, people, and metrics. An OpenAPI specification is available at api.span.app/docs-next.

Authenticate with a bearer token: a personal access token, or a service account for shared tools and automation.
Every token is limited to what its owner or permission group can see.

Span MCP server

Connect Claude Code, Claude Desktop, Cursor, or any MCP-compatible client to your Span data at https://api.span.app/mcp.

Sign in with OAuth 2.0, or use a bearer token for read-only access.
Read access covers metrics, pull requests, issues, teams, DORA, surveys, and AI agent sessions. A small set of write actions requires OAuth.
Built-in prompts produce common reports, such as team health, DORA summary, and AI adoption.
A Span skill for Claude Code and Cursor is also available on GitHub.

AI coding activity (coding hooks)

Coding hooks run on developer machines and capture activity inside AI coding tools only.

Captured	Not captured
Prompts and model details	Keystrokes
Tool calls the AI agent makes, with their inputs and results	Browser activity
File edits made by the AI agent	Terminal sessions the developer runs directly
Session start, end, and timing	Files the AI agent did not edit
Git branch, commit author, and repository	Anything outside AI coding tools

Redaction. Secrets and personal information are redacted on the developer's machine before data leaves it, and again on Span's servers before storage. Redaction runs inside Span's infrastructure and is never sent to a third party. You can add your own redaction patterns.
Visibility. By default, the contents of a trace (prompts and responses) are visible only to the developer who created it. Others can be granted access to summary data such as cost and model usage.

Network access

If you use self-hosted tools such as GitHub Enterprise Server, GitLab, or Jira, allowlist Span's outbound IP ranges, published at https://ip-ranges.span.app/ipv4.txt.

Setup

Your Span team sets up SSO and SCIM with your IT admin during onboarding. Admins create API tokens and service accounts in Span's settings.

Things to know

SCIM controls access, not accounts. People must already exist in Span. SCIM does not sync team structure or set permissions.
Email is the unique identifier. If someone's email changes, Span treats them as a new user.
Need a security questionnaire or our security documentation? Ask your Span team.

Supported integrations
Supported AI coding tools

Need help?

Reach out to your Span team or email support@span.app.