## How Atlan connects to Cyera

URL: https://docs.atlan.com/apps/connectors/privacy/cyera/concepts/how-atlan-connects-to-cyera

> Understand how Atlan securely connects to Cyera to extract data classification metadata.

Atlan connects to Cyera's cloud API to extract data classification metadata, including classifications, sensitivity context, security issue findings, and identity access metadata, while maintaining security and compliance. Cyera uses a fixed API endpoint (`api.cyera.io`) and JWT-based authentication via Client ID and Client Secret.

## Connect to Cyera

The Cyera workflow supports two connectivity modes. **Direct** mode establishes a direct HTTPS connection from the Atlan SaaS tenant to the Cyera API using credentials you generate in Cyera. **Self-Deployed Runtime (SDR)** mode lets the runtime in your environment hold the credential and push metadata to Atlan. See [Self-Deployed Runtime](https://docs.atlan.com/llms/platform/self-deployed-runtime/llms.txt) for setup requirements.

The sequence below shows the direct connectivity flow.

```mermaid
sequenceDiagram
 participant User as User
 participant Atlan as Atlan SaaS Tenant
 participant Cyera as Cyera API (api.cyera.io)

 User->>Atlan: Provide Client ID and Client Secret
 Atlan->>Cyera: Authenticate via /v1/login (HTTPS port 443)
 Cyera-->>Atlan: Return JWT access token
 Atlan->>Cyera: Query /v2/datastores for datastore inventory
 Cyera-->>Atlan: Return datastores list
 Atlan->>Cyera: Stream /v1/tables/stream for classification metadata
 Cyera-->>Atlan: Return table and column classifications (NDJSON)
 Atlan->>Cyera: Query /v3/issues for security findings
 Cyera-->>Atlan: Return issues by datastore
 Atlan->>Cyera: Query /v1/datastores/{uid}/identities for identity access metadata
 Cyera-->>Atlan: Return identities by datastore
 Atlan-->>User: Enriched assets in Atlan (tags + custom metadata)
```

- Atlan authenticates using short-lived JWT tokens obtained via the `/v1/login` endpoint with Client ID and Client Secret.
- Atlan queries four Cyera API surfaces:
 - `/v2/datastores`: datastore inventory for mapping in the workflow UI.
 - `/v1/tables/stream`: table and column classifications, streamed as NDJSON.
 - `/v3/issues`: security issue findings, aggregated at the database level.
 - `/v1/datastores/{uid}/identities`: identity access metadata, aggregated at the database level.
- **You can browse and select Cyera Datastores from a dropdown list** in the workflow configuration, populated by querying the Cyera datastores endpoint.

For details on how direct connectivity works, see [Direct connectivity](https://docs.atlan.com/llms/catalog/connector-capabilities/direct-connectivity/llms.txt).

## Security

Atlan extracts only classification metadata: data class names, sensitivity levels, tokenization status, and security issue summaries. For example, if Cyera has classified a `CUSTOMERS` table as containing PII, Atlan discovers the classification and sensitivity information, but never accesses or stores the customer records themselves.

- **Read-only operations**: All Cyera API calls are read-only. The connector can't modify classifications, create or delete policies, or change any Cyera configuration. The permissions granted to the API token control exactly what the connector can access.

- **Credential encryption**: Cyera Client ID and Client Secret values are encrypted at rest and in transit. Atlan encrypts credentials before storage and uses them only to obtain short-lived JWT tokens for API calls.

- **Fixed API endpoint**: Cyera exposes a single cloud API endpoint (`api.cyera.io`). Atlan connects only to this endpoint. No direct access to your underlying data stores occurs during the crawl.

## See also

* [Direct connectivity](https://docs.atlan.com/llms/catalog/connector-capabilities/direct-connectivity/llms.txt): How Atlan connects directly to data sources
* [Set up Cyera](https://docs.atlan.com/llms/connectors/cyera/set-up-cyera/llms.txt): Create an API token and obtain credentials
* [Crawl Cyera](https://docs.atlan.com/llms/connectors/cyera/crawl-cyera/llms.txt): Configure and run the crawler

---