Skip to content

Workato encryption, keys & secrets security checks

Encryption at rest and in transit, key rotation, and the API keys, tokens and credentials that outlive the people who created them.

On Workato, Black Cat runs 7 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Workato connector needs.

Checks (7)

severity: high API Client No IP Restriction fix difficulty: medium #

Configure IP allowlisting on the API Platform client to restrict access by source IP

  1. Log in to Workato and navigate to Platform > API Clients (API Platform section)
  2. Select the API client that lacks IP restrictions
  3. Under "Access control", enable "IP allowlist"
  4. Add the CIDR ranges or IP addresses that are authorized to call this client
  5. Save the changes and confirm the allowlist is active

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12

severity: medium Excessive API Clients fix difficulty: easy #

Review and remove developer API clients that are no longer in use

  1. Log in to Workato and navigate to Workspace Admin > API Clients
  2. Review the list of developer API clients and their last-used dates
  3. Identify clients that are stale, duplicated, or no longer needed
  4. Click the client name and select "Delete" for each unnecessary client
  5. Confirm deletion and update any affected integrations to use the remaining clients

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12

severity: low API Endpoint Inactive fix difficulty: easy #

Activate or remove the inactive API endpoint in Workato API Platform

  1. Log in to Workato and navigate to Platform > API Collections
  2. Locate the API collection containing the inactive endpoint
  3. Open the endpoint details and review why it is inactive
  4. Either activate the endpoint by enabling it, or delete it if it is no longer needed
  5. Confirm the endpoint status is updated and save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12

severity: high API Platform Client Static Auth Token fix difficulty: medium #

Replace static auth token authentication with JWT or OAuth2 for API platform clients

  1. Log in to Workato and navigate to Platform > API Platform > Clients
  2. Open the client flagged as using a static auth token
  3. Under "Authentication", change the auth type from "Auth token" to "JWT" or "OAuth 2.0"
  4. Configure the new authentication method with appropriate keys or client credentials
  5. Distribute the updated credentials to consuming applications and revoke the old token
  6. Verify the client authenticates successfully with the new method

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12

severity: medium API Platform Client No Active Keys fix difficulty: easy #

Remove or provision keys for the orphaned API platform client

  1. Log in to Workato and navigate to Platform > API Platform > Clients
  2. Locate the client with no active keys
  3. Determine whether the client is still in use by checking recipe references and integration logs
  4. If unused, delete the client to eliminate the orphaned entry
  5. If still needed, generate a new API key and distribute it to the consuming application
  6. Confirm the client shows at least one active key or is removed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12

severity: high Developer API Client with Admin Role fix difficulty: medium #

Replace the admin role on the developer API client with a least-privilege role

  1. Log in to Workato and navigate to Workspace Admin > API Clients
  2. Open the API client flagged as having an admin role
  3. Change the assigned role to the minimum required for the client's integration purpose
  4. Save the change and rotate the API token to invalidate any sessions using the old token
  5. Update the consuming application with the new token and verify it continues to function
  6. Monitor for any permission errors that indicate further role adjustment is needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12

severity: low API Platform Client No Key Rotation fix difficulty: medium #

Implement key rotation by revoking old keys after issuing new ones

  1. Log in to Workato and navigate to Platform > API Platform > Clients
  2. Open the client that shows no revoked keys
  3. Generate a new API key for the client
  4. Distribute the new key to consuming applications and update their configuration
  5. Revoke at least one old key once the new key is confirmed working
  6. Document the key rotation in your secrets management runbook and schedule the next rotation

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8

More Workato checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial