> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# GitLab

> Authorize Enclave to read your GitLab projects, run merge request analysis, and post findings as MR comments.

Connect GitLab so Enclave can read your projects, review merge requests, and comment with verified findings. Works with GitLab.com and self-hosted GitLab 14 or newer.

## Before you start

* You need the **Owner** or **Admin** role in Enclave.
* Enclave lists the GitLab groups where you have the **Developer** role or higher.
* To add the webhook, you need the **Maintainer** role on each project, or the **Owner** role on the group. Group webhooks need GitLab Premium or Ultimate.
* For self-hosted GitLab, the access token needs the `api` scope and the **Maintainer** role.

> [!WARNING]
>
> Without the webhook, Enclave can't see new commits or merge requests, and the connection stays pending.

## Connect GitLab

**1. Open integrations**

Open **Settings → Integrations** in [app.enclave.ai](https://app.enclave.ai). Click **Connect** next to **GitLab**.

**2. Authorize GitLab**

Choose **GitLab.com**, sign in to your GitLab account, and authorize the Enclave application.

> [!NOTE]
>
> GitLab's OAuth grants Enclave the `api` scope. GitLab has no narrower scope that allows posting MR comments and managing webhooks. Enclave uses it to read projects and merge requests, post MR comments, and receive webhook events.

> [!TIP]
>
> Using self-hosted GitLab? Choose **Self-hosted GitLab**. Enter your instance URL without `/api/v4`, and paste an access token with the `api` scope and the **Maintainer** role. Add a private CA bundle if your instance uses an internal certificate authority. Then click **Validate & connect**. If your plan doesn't include self-hosted GitLab, **Connect** goes straight to GitLab.com.

**3. Add the webhook**

Enclave shows a **Webhook URL** and a **Secret token**. Copy both. The secret is shown only once.

In GitLab, open your project (or group, for self-hosted) and go to **Settings → Webhooks**. Paste the URL and secret token, enable **Push events** and **Merge request events**, and click **Add webhook**. Click **Test** to send a delivery.

The connection stays pending until the first event arrives.

**4. Choose which projects get MR reviews**

Automatic reviews are on by default for every GitLab project. To turn them off for a project, use its **PR Reviews** switch in **Coverage → Repositories**. See [PR and dependency analysis](https://docs.enclave.ai/risk/pr-analysis.md).

## Tips

* **Create a dedicated GitLab account** for Enclave so MR comments are clearly attributed. For self-hosted GitLab, a service-account token is best, then a group access token. A personal token works, but every comment appears under your name.
* **Connect every project in a system.** Enclave finds cross-service issues only when it can see both the service and the APIs it calls.

## Troubleshooting

For self-hosted GitLab, **Validate & connect** checks your URL and token first:

* **Enclave requires GitLab 14 or newer**: upgrade your instance.
* **GitLab rejected the token** or **The token must include the 'api' scope**: issue a new token with the `api` scope.
* **The token authenticated but cannot see any projects**: add the token to a group or project first.
* **We refused to call that URL**: the hostname resolved to a private or internal address. Enclave doesn't connect to those.
* **We could not reach your GitLab instance**: check the URL and your firewall rules.

To rotate a self-hosted token, connect again with a new token for the same instance. Enclave updates the existing connection and keeps your webhook working. Revoke the old token in GitLab afterward.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.