# Snyk
URL: https://docs.clearly-ai.com/docs/integrations/security/snyk
Description: Connect Snyk to Clearly AI to import vulnerability and code-security findings as project sources, and scan repositories from workflows.
## Overview [#overview]

The Snyk integration imports Snyk project findings as Clearly AI project sources. Clearly AI renders those findings as review and chat context.

The integration supports:

* Personal access token or service account token authentication.
* Regional Snyk API base URLs (for example `https://api.snyk.io`, `https://api.eu.snyk.io`, `https://api.au.snyk.io`).
* Listing Snyk organizations and projects available to the token.
* Fetching a findings snapshot for a Snyk project with severity, status, and issue-type filters.
* **Scan Project With Snyk** workflow steps that import supported code repositories already on a Clearly AI project into Snyk and attach the resulting Snyk projects as sources.

Clearly AI reads findings from Snyk. It does not resolve or ignore issues back in Snyk.

## Connect Snyk [#connect-snyk]

1. In Clearly AI, open **Organization settings**, select **Integrations**, then click **Set up** on the Snyk card.
2. Under **Authentication**, in **Shared API Token**, paste a Snyk personal access token or service account token.
3. In **Snyk API base URL**, enter the REST API host for your Snyk region if it is not the default `https://api.snyk.io`.
4. Check **I understand** under the shared-credential notice, then click **Add workspace credential**. Clearly AI tests the credential and enables the integration only when the test passes.

A successful test confirms the token can list at least one Snyk organization at the configured API host.

<Note>
  Use a dedicated Snyk service account when multiple people share the integration. The token needs read access to the organizations and projects you want to import.
</Note>

## Add Snyk findings to a project [#add-snyk-findings-to-a-project]

1. Open **Projects** and select the project you want to review.
2. Open **Manage Sources** and select **Search Integrations**.
3. Choose **Snyk**.
4. Select a **Snyk organization** and **Snyk project**.
5. Configure snapshot filters such as minimum severity, whether to exclude ignored issues, open issues only, issue types, and the maximum number of issues included in the snapshot.
6. Save the source and wait for processing to finish.

The imported source is a markdown snapshot of matching Snyk issues at save time. Regenerate the source or add a new one when you need fresher findings.

## Scan repositories from a workflow [#scan-repositories-from-a-workflow]

The **Scan Project With Snyk** workflow step scans supported code repositories already attached to a Clearly AI project:

* GitHub, GitLab, Bitbucket, and Azure Repos repositories and branches on the project.
* Imports each repository into a chosen Snyk organization (Snyk creates one project per detected manifest).
* Waits for each import job to finish or time out, then adds the resulting Snyk projects back to the Clearly AI project as sources.

Configure:

* **Project** — the Clearly AI project whose repository sources should be scanned.
* **Snyk organization** — required when the token can see more than one org; otherwise Clearly AI auto-selects the only org.
* **Manifest files** (optional) — limit imports to specific paths (for example `package.json` or `services/api/pom.xml`). Leave empty to let Snyk auto-detect manifests.
* **Poll timeout (seconds)** (optional) — how long to wait per repository import before treating it as timed out.

The matching source-control integration must already be configured in the target Snyk organization (for example GitHub connected inside Snyk). Clearly AI calls Snyk's import API; it does not replace Snyk's SCM setup.

## FAQs [#faqs]

<Accordions>
  <Accordion title="Why does the connection test fail?">
    Confirm the token is active, the **Snyk API base URL** matches your tenant region, and the token can list organizations in Snyk. Regenerate the token if it was revoked.
  </Accordion>

  <Accordion title="Why are no Snyk projects listed for an organization?">
    Confirm the token can read projects in that org. If you filter by a repository, the listing only includes Snyk projects whose target matches that repo or branch.
  </Accordion>

  <Accordion title="Why did Scan Project With Snyk skip or fail a repository?">
    Common causes: the repo is not a supported entity type, the SCM integration is missing in the Snyk org, the import job failed or timed out, or the token cannot import into the selected organization.
  </Accordion>

  <Accordion title="Why do findings look stale?">
    Snyk sources are point-in-time snapshots. Add the source again or run **Scan Project With Snyk** in a workflow when you need updated scan results.
  </Accordion>
</Accordions>

## Related [#related]

* [Reviews](https://docs.clearly-ai.com/docs/reviews)
* [Workflows](https://docs.clearly-ai.com/docs/workflows)
* [Integrations](https://docs.clearly-ai.com/docs/integrations)