Drata | cside docs

Connect cside to Drata to push the domains cside monitors into your Drata workspace. cside creates a custom connection called cside and fills it with one record per monitored domain, so your auditors can see which sites are monitored, which have script blocking on, and which are configured for CSP reporting.

Rolling out gradually

The Drata integration is rolling out gradually. If you don’t see Connect Drata under Compliance in your integrations settings yet, contact support@cside.dev to enable it for your team. Domain records are not synced on a schedule yet, so ask support to run the sync once you are connected.

What cside syncs

Each monitored domain becomes one record in the cside custom connection:

Field	What it means
`domain`	The monitored domain, used as the record’s display name in Drata
`team`	The cside team that owns the domain
`monitoring`	`MONITORED` for active domains, `SUSPENDED` for paused ones
`scriptBlockingEnabled`	Whether cside blocks unapproved scripts on this domain
`paymentPagesConfigured`	Whether checkout paths are configured, which PCI DSS 4.0.1 requires
`cspOnboardingCompleted`	Whether CSP reporting is set up
`addedAt`	When the domain was added to cside
`externalUrl`	A link back to the domain in your cside dashboard

A sync replaces the full record set, so domains you remove in cside disappear from Drata on the next sync.

Prerequisites

You need:

A cside organization admin account, or a cside team where you have the editor role
A Drata admin account, since only admins can create API keys
Your Drata region: United States, Europe, or Asia Pacific

Creating a Drata API key

Drata does not offer OAuth apps for its public API, so cside connects with an API key that you create.

In Drata, go to Settings > API Keys
Create a key with read and write access to Custom Connections and read access to Workspaces
Copy the key, Drata shows it only once

See Drata’s guide to API keys for the full walkthrough.

Keys are region specific

Drata runs separate deployments per region. A key created in the European deployment does not work against the United States one. If cside rejects a valid looking key, check the region before creating a new key.

Connecting Drata

Open the dashboard and go to Team Settings > Integrations
Under Compliance, click Connect Drata
Paste your API key and pick your Drata region
Click Connect Drata

cside validates the key straight away. If it fails, the two common causes are a key from another region and a key without access to custom connections.

Once connected, cside creates the cside custom connection in Drata if it does not exist yet, and attaches it to every workspace in your Drata account. Reconnecting later reuses the same connection instead of creating a second one.

Connecting sets up the connection and its record schema. The domain records themselves arrive with the first sync.

Finding your data in Drata

In Drata, go to Connections > All Connections and open the cside card under Active. The connection page shows the record schema, and the Manage tab lists one record per monitored domain, labelled by domain name.

Until cside runs your first sync, the Manage tab is empty even though the connection itself is set up correctly. Once records are there, each one shows a Last updated time you can use to confirm how current it is.

Building a test on your cside data

Open the connection’s Monitoring tab and choose to create a test. Drata prefills the provider and resource, and every cside field is available as a condition. For example, you can require that every cside record has monitoring set to MONITORED.

Disconnecting Drata

Go to Team Settings > Integrations and click Disconnect Drata. cside deletes your API key and stops sending data to Drata.

The custom connection stays in Drata with its last synced data, so historical evidence survives the disconnect. Delete it in Drata if you want the records gone. Reconnecting later picks the same connection back up rather than starting a new one.