---
schema_version: "1"
id: b732eb97a5a45c08d724e3b7cc9fc722c36a6c0daef93f4ab1cfc3f640e660f0
title: Scanner Prerequisites by Provider
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/general/exp-scanners-prerequisites-reference.md
canonical_url: https://docs.mulesoft.com/general/exp-scanners-prerequisites-reference
source_site: docs.mulesoft.com
content_type: documentation
content_hash: f39dba70afa12a30eb3f3886f81c7cc24c4626e2ee900ae558c2cd093945cbfa
description: MuleSoft Documentation Site
latest: true
---
---
product: Getting Started
keywords: scanner prerequisites, exchange scanners, provider scanners, required roles, required credentials, scanner setup, vaults
---

# Scanner Prerequisites by Provider

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Scanner prerequisites by provider help you confirm required roles, credentials, and permissions
before creating a scanner. Use this reference to prevent connection test failures and incomplete
discovery by validating provider-specific access in advance. Each scanner also requires Exchange
Administrator permission and the correct business group context.

For API gateway providers that support policy write, discovery access alone isn’t enough to apply
policies. Policy write reuses the same scanner connection you configure here, so the connection’s
credentials must also carry the provider’s write permissions (write scope). Review the additional
write prerequisites in the Scanner Prerequisites Matrix. Write scopes are noted in the matrix as
**Write scope (policy apply)**.

## Before You Begin

Before adding any scanner, make sure you have:

- Exchange Administrator permission.

- Access to, and active context in, the business group where you want to add the scanner.

## Scanner Prerequisite Matrix

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Provider</th><th>Type</th><th>Required Credentials, Roles, and Setup</th></tr></thead><tbody><tr><td><p>Amazon Bedrock</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> Access key ID and secret access key; AWS region</p></div><div><p><strong>Permissions:</strong></p></div><div><ul><li><p><code>bedrock:ListAgents</code></p></li><li><p><code>bedrock:GetAgent</code></p></li><li><p><code>bedrock:ListAgentAliases</code></p></li><li><p><code>bedrock:GetAgentAlias</code></p></li><li><p><code>bedrock:ListAgentVersions</code></p></li><li><p><code>bedrock:GetAgentVersion</code></p></li></ul></div><div><p><strong>Optional (for agent invocation workflows):</strong></p></div><div><ul><li><p><code>bedrock:InvokeModel</code></p></li><li><p><code>bedrock:InvokeAgent</code></p></li><li><p><code>bedrock:InvokeInlineAgent</code></p></li></ul></div><div><p><strong>Setup:</strong> Agents must have an alias linked to a version and an invocable URL</p></div></div></td></tr><tr><td><p>Amazon Bedrock AgentCore Runtime</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> Access key ID and secret access key; AWS region</p></div><div><p><strong>Account:</strong> Active AWS account with AgentCore access</p></div><div><p><strong>Permissions:</strong></p></div><div><ul><li><p><code>bedrock-agentcore:ListAgentRuntimes</code></p></li><li><p><code>bedrock-agentcore:ListAgentRuntimeEndpoints</code></p></li><li><p><code>bedrock-agentcore:GetAgentCard</code></p></li><li><p><code>bedrock-agentcore:GetAgentRuntime</code></p></li><li><p><code>bedrock-agentcore:ListAgentRuntimeVersions</code></p></li><li><p><code>bedrock:GetAgent</code></p></li><li><p><code>bedrock:ListAgents</code></p></li></ul></div><div><p><strong>Setup:</strong> Agents must be published with an active endpoint/version</p></div></div></td></tr><tr><td><p>Anthropic Claude Managed Agents</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> Claude API key</p></div><div><p><strong>Account:</strong> Paid Anthropic account</p></div></div></td></tr><tr><td><p>Databricks Agent Bricks</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> Workspace URL; client ID and client secret</p></div><div><p><strong>Account:</strong> Databricks workspace access</p></div><div><p><strong>Permissions:</strong> Service principal <code>CAN_QUERY</code> on serving endpoints; <code>CAN_VIEW</code> or higher on endpoint metadata APIs</p></div><div><p><strong>Setup:</strong> Discoverable agents must be custom Unity Catalog models in <code>READY</code> state</p></div></div></td></tr><tr><td><p>GoDaddy ANS</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> API key and API secret</p></div></div></td></tr><tr><td><p>Google Gemini Agent Enterprise Platform</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> GCP project ID; service account email; private key</p></div><div><p><strong>Role:</strong> Vertex AI Viewer</p></div></div></td></tr><tr><td><p>LangChain LangSmith</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> LangSmith API key; LangSmith workspace ID</p></div><div><p><strong>Account:</strong> LangSmith Plus plan (or higher) workspace</p></div><div><p><strong>Setup:</strong> Optional API host for region routing (for example, US or EU cloud host)</p></div></div></td></tr><tr><td><p>Microsoft Azure Copilot</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> Azure app registration; client ID and client secret. Two authentication schemes are supported:</p></div><div><ul><li><p><strong>OAuth (Authorization Code):</strong> Interactive sign-in and consent in a Microsoft popup. This scheme requires a pre-configured customer OAuth application. Configure the OAuth application in Azure to request the Dynamics CRM <code>user_impersonation</code> scope, and set the OAuth callback URL to <code><a href="https://&lt;your_anypoint_host&gt;/secrets-manager/api/v1/connections/oauth/callback">https://&lt;your_anypoint_host&gt;/secrets-manager/api/v1/connections/oauth/callback</a></code>. Tenant ID is optional; if you don’t provide one, the connection defaults to the home tenant ID after authorization.</p></li><li><p><strong>OAuth:</strong> Uses client credentials, with no interactive sign-in. Tenant ID is required.</p></li></ul></div><div><p><strong>Role:</strong> Copilot Studio Scanner</p></div><div><p><strong>Setup:</strong> App added as an Application User in Power Platform; scope set to Dataverse environment URL, <code><a href="https://&lt;org-id&gt;.crm.dynamics.com">https://&lt;org-id&gt;.crm.dynamics.com</a></code></p></div><div><p>For setup steps, see <a href="https://docs.mulesoft.com/general/exp-scanners-add-from-providers#microsoft-copilot-studio-scanner-oauth-authorization">exp-scanners-add-from-providers.adoc#microsoft-copilot-studio-scanner-oauth-authorization</a>.</p></div></div></td></tr><tr><td><p>Microsoft Foundry</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> Azure app registration; tenant ID, client ID, client secret</p></div><div><p><strong>Account:</strong> Active Azure subscription</p></div><div><p><strong>Role:</strong> Azure AI Developer</p></div><div><p><strong>Setup:</strong> Project endpoint URLs (discovery is project-specific)</p></div></div></td></tr><tr><td><p>Salesforce Agentforce</p></td><td><p>Agent</p></td><td><div><div><p><strong>Connection:</strong> <a href="https://docs.mulesoft.com/access-management/managing-connected-salesforce-orgs#enable-disable-connection">Enable the connection to a Salesforce organization</a> that has an established tenant relationship with your Anypoint Platform organization.</p></div><div><p><strong>Setup:</strong> <a href="https://docs.mulesoft.com/access-management/enabling-generative-ai#enable-einstein-anypoint">Enable generative AI in Anypoint Platform</a>, accept the terms and conditions, and set a default Salesforce organization</p></div><div><p><strong>Permissions:</strong> Exchange Administrator permission</p></div></div></td></tr><tr><td><p>ServiceNow AI Agents</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> Instance URL; OAuth client ID and client secret</p></div><div><p><strong>Permissions:</strong> Table API integration user with read access to the <code>alm_ai_*</code> tables</p></div><div><p><strong>Setup:</strong> Application Registry entry in ServiceNow to generate the OAuth client ID and client secret; AI Asset Governance enabled and synced on the ServiceNow instance</p></div></div></td></tr><tr><td><p>Snowflake Cortex AI</p></td><td><p>Agent</p></td><td><div><div><p><strong>Credentials:</strong> Snowflake account URL; programmatic access token (PAT)</p></div><div><p><strong>Account:</strong> Snowflake account with Cortex Agents enabled (Enterprise edition)</p></div><div><p><strong>Role:</strong> <code>ACCOUNTADMIN</code>, for one-time setup only</p></div><div><p><strong>Setup:</strong> At least one Cortex Agent created in a schema to be scanned; scanner egress IP ranges from your Anypoint deployment team (<code>&lt;SCANNER_EGRESS_CIDRS&gt;</code>)</p></div></div></td></tr><tr><td><p>Amazon API Gateway</p></td><td><p>API</p></td><td><div><div><p><strong>Credentials:</strong> Access key ID and secret access key; AWS region</p></div><div><p><strong>Permissions:</strong> IAM read-only policy for API Gateway:</p></div><div><ul><li><p><strong>Read permission:</strong> <code>apigateway:GET</code></p></li><li><p><strong>Read action group:</strong> <code>apigateway:GET*</code> on REST and HTTP API resources</p></li><li><p><strong>Resource scope (REST APIs):</strong> <code>arn:aws:apigateway:{region}::/restapis/*</code></p></li><li><p><strong>Resource scope (HTTP APIs):</strong> <code>arn:aws:apigateway:{region}::/apis/*</code></p></li></ul></div><div><div data-type="NOTE">For web application firewall (WAF) policies, the scanner also uses <code>software.amazon.awssdk:wafv2</code> and <code>software.amazon.awssdk:route53</code>.</div></div></div></td></tr><tr><td><p>Azure API Management</p></td><td><p>API</p></td><td><div><div><p><strong>Credentials:</strong> Tenant ID; client ID; client secret; subscription ID; resource group; service name</p></div><div><p><strong>Role:</strong> API Management Service Reader</p></div><div><ul><li><p><strong>Read role scope:</strong> API Management Service Reader at the API Management resource or resource group scope</p></li><li><p><strong>Read OAuth scope:</strong> <code><a href="https://management.azure.com/.default">https://management.azure.com/.default</a></code></p></li></ul></div><div><p><strong>Write scope (policy apply):</strong> API Management Service Contributor role (ARM) at the API Management resource or resource group scope</p></div></div></td></tr><tr><td><p>Google Apigee</p></td><td><p>API</p></td><td><div><div><p><strong>Credentials:</strong> GCP project ID; service account email; private key</p></div><div><p><strong>Role:</strong> Apigee Read-only Admin</p></div><div><ul><li><p><strong>Read role:</strong> Service account with the Viewer role, or an Apigee permission role with equivalent read access</p></li></ul></div><div><p><strong>Write scope (policy apply):</strong> API Admin role (Management API), or an Apigee permission role with equivalent write access</p></div></div></td></tr><tr><td><p>Kong Gateway</p></td><td><p>API</p></td><td><div><div><p><strong>Credentials:</strong> Personal access token (PAT); Kong Gateway region</p></div><div><p><strong>Role:</strong> Kong Control Plane Viewer</p></div><div><ul><li><p><strong>Apply read scope:</strong> Admin API read permission required to read policy in target environments</p></li></ul></div><div><p><strong>Write scope (policy apply):</strong> Admin API write permission required to apply, enable, disable, or remove policy in target environments</p></div><div><p><strong>Setup:</strong> To discover accurate, typed API definitions, link each Kong Gateway service to a Catalog API that has an attached OpenAPI Specification (OAS). For the required workflow and route-discovery limitations, see <a href="https://docs.mulesoft.com/general/exp-scanners-add-from-providers#kong-gateway-scanner">Kong Gateway Scanner</a>.</p></div></div></td></tr><tr><td><p>Akamai Security</p></td><td><p>API Security</p></td><td><div><div><p><strong>Credentials:</strong> Akamai Security base URL; client ID and client secret</p></div><div><p><strong>Permissions:</strong> Access to create service accounts in Akamai Security; access to apply Akamai correlation policy in target environments</p></div><div><p><strong>Setup:</strong> Existing services in <strong>Portfolio</strong> catalogs for correlation targets; create a connected app in MuleSoft; configure Akamai-side sync with the MuleSoft connected app. For details, see <a href="https://docs.mulesoft.com/general/exp-akamai-risk-correlation">Correlating Risk Using Akamai API Security</a>.</p></div></div></td></tr><tr><td><p>Amazon Bedrock AgentCore MCP</p></td><td><p>MCP</p></td><td><div><div><p><strong>Credentials:</strong> Access key ID and secret access key; AWS region</p></div><div><p><strong>Account:</strong> Active AWS account</p></div><div><p><strong>Permissions:</strong> IAM user with an inline policy that allows:</p></div><div><ul><li><p><code>bedrock-agentcore:ListAgentRuntimes</code></p></li><li><p><code>bedrock-agentcore:GetAgentRuntime</code></p></li><li><p><code>bedrock-agentcore:ListAgentRuntimeVersions</code></p></li><li><p><code>bedrock-agentcore:ListAgentRuntimeEndpoints</code></p></li><li><p><code>bedrock-agentcore:InvokeAgentRuntime</code></p></li></ul></div><div><p><strong>Policy read permissions:</strong> Runtime read actions, including <code>bedrock-agentcore:ListAgentRuntimes</code> and <code>bedrock-agentcore:GetAgentRuntime</code></p></div></div></td></tr><tr><td><p>Azure API Management MCP Server</p></td><td><p>MCP</p></td><td><div><div><p><strong>Credentials:</strong> Tenant ID; client ID; client secret; subscription ID; resource group; service name</p></div><div><p><strong>Role:</strong> API Management Service Reader</p></div></div></td></tr><tr><td><p>Kong Gateway MCP Server</p></td><td><p>MCP</p></td><td><div><div><p><strong>Credentials:</strong> Personal access token (PAT); Kong Gateway region</p></div><div><p><strong>Role:</strong> Kong Control Plane Viewer</p></div><div><p><strong>Read scope:</strong> Admin API read permission required to discover MCP servers in target environments</p></div><div><p><strong>Setup:</strong> Create the MCP servers for the scanner to discover in one of two ways:</p></div><div><ul><li><p>In the Kong control plane, add a gateway service and attach an MCP-related plugin to it.</p></li><li><p>In Kong Catalog, open <strong>MCP Servers</strong> and create a new MCP server, then link a gateway service to it.</p></li></ul></div><div><p>Each MCP server must have a linked gateway service. The scanner doesn’t discover MCP servers that have no linked gateway service.</p></div><div><p>The MCP servers reflect only the routes present in the control plane gateway services. For route-discovery limitations, see <a href="https://docs.mulesoft.com/general/exp-scanners-add-from-providers#kong-gateway-scanner">Kong Gateway Scanner</a>.</p></div></div></td></tr><tr><td><p>Snowflake MCP Server</p></td><td><p>MCP</p></td><td><div><div><p><strong>Credentials:</strong> Snowflake account URL; programmatic access token (PAT)</p></div><div><p><strong>Account:</strong> Snowflake Enterprise account with MCP servers enabled</p></div><div><p><strong>Role:</strong> <code>ACCOUNTADMIN</code></p></div></div></td></tr><tr><td><p>Amazon (AWS Secrets Manager)</p></td><td><p>Vault</p></td><td><div><div><p><strong>Credentials:</strong> AWS Static (Access Key ID and Secret Access Key) or AWS Assume Role (Access Key ID and Secret Access Key, plus Role ARN and External ID)</p></div><div><p><strong>Setup:</strong> Vault URL; AWS region; optional Secret Name Prefix</p></div></div></td></tr><tr><td><p>Microsoft (Azure Key Vault)</p></td><td><p>Vault</p></td><td><div><div><p><strong>Credentials:</strong> Azure Sp Secret (Client Secret) or Azure Sp Certificate (Client Certificate and Private Key, in PEM format)</p></div><div><p><strong>Setup:</strong> Vault URL; Client ID; Tenant ID</p></div></div></td></tr><tr><td><p>HashiCorp (HashiCorp Vault)</p></td><td><p>Vault</p></td><td><div><div><p><strong>Credentials:</strong> HashiCorp Approle (Role ID and Secret ID, plus an optional TLS CA Certificate in PEM format)</p></div><div><p><strong>Setup:</strong> Vault URL; KV Version; Engine Type; Mount; Path; optional Namespace for Vault Enterprise</p></div></div></td></tr></tbody></table>

## Policy Write Prerequisites

Policy write lets you apply, enable, disable, and remove policies on connected third-party gateway
APIs directly from Anypoint, with no Anypoint gateway in the request path. Policy write is available
for API gateway providers only: Azure API Management, Google Apigee, and Kong Gateway. Agent, API
Security, and MCP scanners don’t support policy write.

Policy write reuses the same connection you configure for scanning; there’s no separate policy-write
connection. Before you can write policies, confirm these prerequisites in addition to the discovery
prerequisites in the matrix:

- **Write permissions on the connection:** The scanner connection’s identity must have the
  provider’s write scope, not just read access. A connection with read-only access to the provider
  can discover and read policies, but policy actions remain unavailable.

- **Write scope:** The write scope covers enabling, disabling, and removing existing vendor-native
  policies, and creating and editing open (canonical) policies, at both the instance and service
  scope. Creating and editing native vendor policies isn’t supported.

- **Provider write permissions:** Grant the provider-specific **Write scope (policy apply)** listed
  for each API gateway provider in the Scanner Prerequisites Matrix.

The following table summarizes the read and write scopes for each API gateway provider that supports
policy write.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Provider</th><th>Read Scope</th><th>Write Scope</th></tr></thead><tbody><tr><td><p>Amazon API Gateway</p></td><td><p><code>apigateway:GET</code></p></td><td><p>Not supported</p></td></tr><tr><td><p>Azure API Management</p></td><td><p>Reader role (ARM)</p></td><td><p>API Management Service Contributor role (ARM)</p></td></tr><tr><td><p>Google Apigee</p></td><td><p>Viewer role (Management API)</p></td><td><p>API Admin role (Management API)</p></td></tr><tr><td><p>Kong Gateway</p></td><td><p>Admin API read</p></td><td><p>Admin API write</p></td></tr></tbody></table>

### Read-Only APIs

When a scanner connection has only read access to a gateway, its API instances appear as
**Read-Only** and policy actions are unavailable. To enable policy write, grant the connection’s
identity the provider’s write scope, then update the connection from the API instance.

### Tracked Applies

Every policy write is tracked and records an applied or failed state alongside the scanner-read
configuration. Anypoint logs each write as compliance evidence, including the policy, the target,
the vendor, the timestamp, and the result. To follow the outcome of a policy operation, use the
**Activity log** tab on the API instance. See
[Tracking Policy Operations in the Activity Log](https://docs.mulesoft.com/general/exp-policies-activity-log).

> [!NOTE] Anypoint doesn’t manage vendor policy lifecycle, versioning, or CI/CD.

## See Also

- [Adding Scanners from Providers](https://docs.mulesoft.com/general/exp-scanners-add-from-providers)

- [Viewing and Managing Provider Connections](https://docs.mulesoft.com/general/exp-providers-manage)

- [Running and Managing Scanners](https://docs.mulesoft.com/general/exp-scanners-manage)

- [Correlating Risk Using Akamai API Security](https://docs.mulesoft.com/general/exp-akamai-risk-correlation)