Workato encryption, keys & secrets security checks
Encryption at rest and in transit, key rotation, and the API keys, tokens and credentials that outlive the people who created them.
On Workato, Black Cat runs 7 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Workato connector needs.
Checks (7)
severity: high API Client No IP Restriction fix difficulty: medium #
Configure IP allowlisting on the API Platform client to restrict access by source IP
- Log in to Workato and navigate to Platform > API Clients (API Platform section)
- Select the API client that lacks IP restrictions
- Under "Access control", enable "IP allowlist"
- Add the CIDR ranges or IP addresses that are authorized to call this client
- Save the changes and confirm the allowlist is active
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: medium Excessive API Clients fix difficulty: easy #
Review and remove developer API clients that are no longer in use
- Log in to Workato and navigate to Workspace Admin > API Clients
- Review the list of developer API clients and their last-used dates
- Identify clients that are stale, duplicated, or no longer needed
- Click the client name and select "Delete" for each unnecessary client
- Confirm deletion and update any affected integrations to use the remaining clients
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: low API Endpoint Inactive fix difficulty: easy #
Activate or remove the inactive API endpoint in Workato API Platform
- Log in to Workato and navigate to Platform > API Collections
- Locate the API collection containing the inactive endpoint
- Open the endpoint details and review why it is inactive
- Either activate the endpoint by enabling it, or delete it if it is no longer needed
- Confirm the endpoint status is updated and save changes
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: high API Platform Client Static Auth Token fix difficulty: medium #
Replace static auth token authentication with JWT or OAuth2 for API platform clients
- Log in to Workato and navigate to Platform > API Platform > Clients
- Open the client flagged as using a static auth token
- Under "Authentication", change the auth type from "Auth token" to "JWT" or "OAuth 2.0"
- Configure the new authentication method with appropriate keys or client credentials
- Distribute the updated credentials to consuming applications and revoke the old token
- Verify the client authenticates successfully with the new method
Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: medium API Platform Client No Active Keys fix difficulty: easy #
Remove or provision keys for the orphaned API platform client
- Log in to Workato and navigate to Platform > API Platform > Clients
- Locate the client with no active keys
- Determine whether the client is still in use by checking recipe references and integration logs
- If unused, delete the client to eliminate the orphaned entry
- If still needed, generate a new API key and distribute it to the consuming application
- Confirm the client shows at least one active key or is removed
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: high Developer API Client with Admin Role fix difficulty: medium #
Replace the admin role on the developer API client with a least-privilege role
- Log in to Workato and navigate to Workspace Admin > API Clients
- Open the API client flagged as having an admin role
- Change the assigned role to the minimum required for the client's integration purpose
- Save the change and rotate the API token to invalidate any sessions using the old token
- Update the consuming application with the new token and verify it continues to function
- Monitor for any permission errors that indicate further role adjustment is needed
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: low API Platform Client No Key Rotation fix difficulty: medium #
Implement key rotation by revoking old keys after issuing new ones
- Log in to Workato and navigate to Platform > API Platform > Clients
- Open the client that shows no revoked keys
- Generate a new API key for the client
- Distribute the new key to consuming applications and update their configuration
- Revoke at least one old key once the new key is confirmed working
- Document the key rotation in your secrets management runbook and schedule the next rotation
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8