A useful third-party integration record answers six questions: who owns it, what it does, what data leaves your systems, how it authenticates, where it runs, and how to switch it off. If a field does not help you answer an incident question quickly, leave it out.
Start from the incident question
Imagine a vendor emails you at 2 a.m. to say it had a problem. Within minutes you need to know which of your services call it, whether personal data goes there, whose credentials are involved, and how to stop sending. Design each field to answer one of those questions.
OWASP's guidance on inventory points the same way. It asks for integrated services to be documented with their role in the system, the data exchanged and its sensitivity. It also describes a "data flow blindspot" when sensitive data goes to a third party without approval, inventory or visibility of what type of data is shared.
The fields
| Field | Why it matters |
|---|---|
| Vendor and product name | Lets you find every use of one vendor |
| API hostnames or SDK package names | Lets you match logs and scans to the row |
| Owning team and named contact | Someone to call |
| Business purpose | Tells reviewers whether it is still needed |
| Data classes sent | Decides who must review it |
| Direction of flow | Outbound, inbound webhook, or both |
| Environments | Production, staging, test |
| Authentication method | API key, OAuth, mutual TLS |
| Credential location and rotation owner | Where the secret is held, not the secret itself |
| Failure behavior | What your product does when the vendor is down |
| Exit plan | How to disable or replace it |
| Last confirmed date | Shows how fresh the row is |
Fields people add too early
Contract renewal dates, pricing tiers and account manager names are useful to procurement, but they rarely help a security question. Link to the contract system instead of copying it.
Never store a secret value in the inventory. Record where it lives and who rotates it.
Keep a short and a long form
Use a short form for low-risk integrations such as a font host or an open data feed: vendor, owner, purpose, date. Use the long form when personal data, payment data, source code or production credentials are involved. Two forms keep the effort proportional.
Try it yourself
Open the demo and notice what a dependency record includes by default: name, version, source. Everything in the table above that is not there is what your team has to add by hand.
Click through it at your own pace, or open it full screen.
Quick check
Should the record include the API key?
No. Record the location of the key and the rotation owner. The value belongs in a secrets manager.
Do inbound webhooks need a record?
Yes. An inbound endpoint is an integration too, and it exposes a public URL on your side.
Safeguard offers SBOM and dependency scanning and asset discovery that can feed this kind of inventory. You can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
